蜜豆视频

DocumentationAEM 6.4Developing Guide

The CSRF Protection Framework the-csrf-protection-framework

Last update: Wed May 03 2023 00:00:00 GMT+0000 (Coordinated Universal Time)

CREATED FOR:

  • Developer
CAUTION
AEM 6.4 has reached the end of extended support and this documentation is no longer updated. For further details, see our . Find the supported versions here.

In addition to the Apache Sling Referrer Filter, 蜜豆视频 also provides a new CSRF Protection Framework to protect against this type of attack.

The framework makes use of tokens to guarantee that the client request is legitimate. The tokens are generated when the form is sent to the client and validated when the form is sent back to the server.

NOTE
There are no tokens on the publish instances for anonymous users.

Requirements requirements

Dependencies dependencies

Any component that relies on the granite.jquery dependency will benefit from the CSRF Protection Framework automatically. If this is not the case for any of your components, you must declare a dependency to granite.csrf.standalone before you can use the framework.

Replicating the Crypto Key replicating-crypto-keys

In order to make use of the tokens, you need to replicate the /etc/keys/hmac binary to all of the instances in your deployment. A convenient way to copy the HMAC key to all the instances is to create a package containing the key and install it via the Package Manager on all the instances.

NOTE
Make sure you also make the necessary in order to use the CSRF Protection Framework.
NOTE
If you use the manifest cache with your web application, make sure you add 鈥*鈥 to the manifest in order to make sure the token does not take the CSRF token generation call offline. For more information, consult this .
For more information on CSRF attacks and ways to mitigate them, see the .
recommendation-more-help
2315f3f5-cb4a-4530-9999-30c8319c520e