[
https://issues.apache.org/jira/browse/OFBIZ-11306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17008008#comment-17008008 ]
James Yong commented on OFBIZ-11306:
------------------------------------
For the error when accessing /EditProdCatalogAjax, the jquery ajax call is missing the following code. Will add in the next patch.
beforeSend: function (jqXHR, settings) {
jqXHR.setRequestHeader("X-CSRF-Token", $("meta[name='csrf-token']").attr("content"));
},
Also note that the html metadata is storing the csrf token used by JQuery AJAX. This token will not change to another value after it is consumed.
Csrf tokens for GET and POST requests are unique for each link and not stored in the html metadata.
> POC for CSRF Token
> ------------------
>
> Key: OFBIZ-11306
> URL:
https://issues.apache.org/jira/browse/OFBIZ-11306> Project: OFBiz
> Issue Type: Improvement
> Components: ALL APPLICATIONS
> Affects Versions: Upcoming Branch
> Reporter: James Yong
> Assignee: Jacques Le Roux
> Priority: Minor
> Labels: CSRF
> Fix For: Upcoming Branch
>
> Attachments: OFBIZ-11306-v2.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306.patch, OFBIZ-11306_Plugins.patch
>
>
> CRSF tokens are generated using CSRF Guard library and used in:
> 1) In widget form where a hidden token field is auto-generated.
> 2) In FTL form where a <@csrfTokenField> macro is used to generate the csrf token field.
> 3) In Ajax call where a <@csrfTokenAjax> macro is used to assign csrf token to X-CSRF-Token in request header.
> CSRF tokens are stored in the user sessions, and verified during POST request.
> A new attribute i.e. csrf-token is added to the security tag to exempt CSRF token check.
> Certain request path, like LookupPartyName, can be exempt from CSRF token check during Ajax POST call.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
Locked
