Possible CSRF Attack with AJAX Request

[Ahmed Mamdouh]

Hello,,

I have a page that tracks an order and returns a json with the result from a database. I created a form on another page and would like to post the tracking number by jquery ajax. I always get a CSRF error. My code is like this:

<script>
var csrf = "${ctx.getAttribute('csrf')!''}";
var mgnlModelExecutionUUID = "${content.@id}";
var trackingNumber = "1234";

var jqxhr = $.post( "track-order.html", {
trackingNumber : trackingNumber , 
csrf:csrf, 
mgnlModelExecutionUUID:mgnlModelExecutionUUID, }, function() {
  alert( "success" );
})
  .fail(function() {
    alert( "error" );
  })
</script>

The same code works if I try a GET request but with POST I always get a csrf error. I know I can disable the csrf filter but why doesn't it work?

Cheers

[Roman Kovařík]

Hi,

Is the POST request bound to the same session? Also debugging CsrfCookieTokenFilter might help.

Regards

Roman

[Ahmed Mamdouh]

Hello,

Thank you for your reply. I am not sure how to verify that.

The browser devtools shows the post request has session cookies. What I noticed though is that the csrf in the cookie is different from the csrf created with the ctx template function.

Regards

[Ahmed Mamdouh]

Update.

It seems this a general issue, even on the contact form in the travel demo website. Not specific to my case.

Any ideas where to look or what might be the cause?

Thanks

[Ahmed Mamdouh]

I restarted the server and it worked. Sorry for bothering.