As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.
hello,
I get CSRF Token "Possible CSRF attack noted when comparing token in session and request parameter" Error when Multipart/formdata is passed in parameter to send file .
Did you configure CSRF properly? Is the client you are using correctly setting the CSRF token in its POST requests?
yes
i had done configuration on share side and also i tried to send token at the time of calling webscript.but after getting token it gives same error.
may be some configuration will be missing so please guide me.
What is the rquest format you are using, what is request URI and what all params you are sending.
What is your current CSRF configuration is share-config-custom.xml file ? Can you also share the full log?
Please share all the details so we can look at it.
<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
<!--Force creation of a Session when the filter matches a path - this should only be used when you areconfident the filtered part of the web application is using an authentication mechanism that will avoidprotected pages being accessed until the user is authenticated. Otherwise this would be a route toa Session fixation attack.--><session>true</session>
<!--Properties that may be used inside the rest of the CSRFPolicy config to avoid repetition butalso making it possible to provide different values in different environments.I.e. Different "Referer" & "Origin" properties for test & production etc.Reference a property using "{propertyName}".--><properties>
<!-- There is normally no need to override this property --><token>alf-csrftoken</token>
<!--Override and set this property with a regexp that if you have placed Alfresco behind a proxy thatdoes not rewrite the Referer header.--><referer></referer>
<!--Override and set this property with a regexp that if you have placed Alfresco behind a proxy thatdoes not rewrite the Origin header.--><origin></origin></properties>
<!--Will be used and exposed to the client side code in Admin.CSRFUse the Admin.CSRF.getHeader() or Admin.CSRF.getParameter() with Admin.CSRF.getToken()to set the token in custom 3rd party code.--><client><cookie>{token}</cookie><header>{token}</header><parameter>{token}</parameter></client>
<!-- The first rule with a matching request will get its action invoked, the remaining rules will be ignored. --><filter>
<!-- Refresh token on each new page visit --><rule><request><method>GET</method><path>/service/enterprise/admin/.*</path></request><action name="generateToken"><param name="session">{token}</param><param name="cookie">{token}</param></action></rule><rule><request><method>GET</method><path>/s/enterprise/admin/.*</path></request><action name="generateToken"><param name="session">{token}</param><param name="cookie">{token}</param></action></rule><rule><request><method>GET</method><path>/service/admin/.*</path></request><action name="generateToken"><param name="session">{token}</param><param name="cookie">{token}</param></action></rule><rule><request><method>GET</method><path>/s/admin/.*</path></request><action name="generateToken"><param name="session">{token}</param><param name="cookie">{token}</param></action></rule>
<!--Verify multipart requests contain the token as a parameterand also correct referer & origin header if available--><rule><request><method>POST</method><header name="Content-Type">multipart/.+</header></request><action name="assertToken"><param name="session">{token}</param><param name="parameter">{token}</param></action><action name="assertReferer"><param name="referer">{referer}</param></action><action name="assertOrigin"><param name="origin">{origin}</param></action></rule>
<!--Verify that all remaining state changing requests contain a token in the header and correct referer & origin headersif available. We "catch" all content types since just setting it to "application/json.*" since a webscript that doesn'trequire a json request body otherwise would be successfully executed using i.e."text/plain".--><!-- <rule><request><method>POST|PUT|DELETE</method></request><action name="assertToken"><param name="session">{token}</param><param name="header">{token}</param></action><action name="assertReferer"><param name="referer">{referer}</param></action><action name="assertOrigin"><param name="origin">{origin}</param></action></rule> --></filter>
</config>
this is my share config.after this code every where in upload api csrf token is getting null.so i cant use inbuilt upload functionality and also get error in my custom upload api too.
please guide me..
