nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco cookie Alfresco-CSRF Token

cco

Hi all,

I am using JMeter (v2.9) to test performance of application based on Alfresco(v5.0.3).

I can not get cookie Alfresco-CSRF Token.

By viewing request in Firefox tools, Alfresco-CSRF Token is given in the Response Header in the request GET /share/page following the request POST /share/page/login.

We have in order :

1. request GET /share/page that sets cookies JSESSIONID; ROUTEECMID; ROUTESHAREID; ROUTESOLRID; CONTLB901

2. request POST /share/page/login that sets JSESSIONID; _alfTest; alfLogin; alfUsername3

3. request GET /share/page that uses in its header cookies : JSESSIONID; _alfTest; alfLogin; alfUsername3; ROUTEECMID; ROUTESHAREID; ROUTESOLRID; CONTLB901. And in its response header, there sould be possible to get Alfresco-CSRF Token.

But, despite sending all needed cookies in the request GET /share/page , there is no cookie Alfresco-CSRF received in the Response Header.

Thanks for your advices

Find more posts tagged with

Alfresco Content Services

Comments

mehe

Hi,

not sure if missed something in your description - the client, in your case jmeter, must have a mechanism to receive and store the cookies. Is your jmeter cookie manager enabled and have set CookieManager.save.cookies=true?

Did you follow articles that describe jmeters use in the context of CSRF protection (i.e. How to Load Test CSRF-Protected Web Sites | BlazeMeter )?

or tried to just turn off or configure the Alfresco CSRF protection temporarily? Cross-Site Request Forgery (CSRF) filters | Alfresco Documentation

cco

Hi Martin,

In Jmeter, Cookie Manager is used. But unfortunaly, no cookie CSRF was present in response header. So no parsing was possible.

The problem was that 3 servers ECM, SHARE and SolR sent your own header and i got JSESSIONID cookie instead of CSRF cookie.

It was resolved by changing apache configuration.

afaust

The GET on /share/page should redirect you with a 302 response to the actual starting page, normally the user dashboard. The GET for the user dashboard should then provide you with the CSRF token, as these are generated on each page rendition request.

mehe

Sorry bothering you with the basic stuff, but it's sometimes hard to see how deep the analysis of the problem went before glad to hear you've got it working

href

Hi @cco ,

I have same problem. Can you tell please what kind of configuration was done in apache file?