Issue
I migrated from CSRFGuard 3.1.0 to 4.0.0 for my project, i have included csrf-session-extension and csrf-jsp-tag dependencies as they are required for migration. After making neccessary changes in properties, I can able to build the maven application and deploy it in tomcat server. However, after requesting data from database, i receive following errors:
org.apache.catalina.core.StandardWrapperValve invoke Servlet.service() for servlet [services] in context with path threw exception com.proj.libs.core.common.exception.ValidationError: Validation Error: Invalid CSRF token. at com.server.security.CsrfFilter.validateCsrfToken(CsrfFilter.java:68) at com.server.security.CsrfFilter.doFilter(CsrfFilter.java:47)
I found out that exception occurs due to my HttpSession not containing CSRFToken attribute hence the validation fails. It occurs only when I start sing CSRFGuard 4.0.0 in project from 3.1.0 . How to resolve this issue?
My property file:
org.owasp.csrfguard.TokenName=OWASP-CSRFTOKEN
org.owasp.csrfguard.SessionKey=OWASP-CSRFTOKEN
Solution
From csrfguard 4.x.x onwards, we don't have csrftoken stored in httpsession so we have to store these tokens in somewhere. We can configure the storage option in property file. I have chosen InMemoryImplementagtion method. Here our session tokens are stored in the memeory. Hence, we can access the session tokens using from the memory storage using the session key.
Answered By - xianbei
Answer Checked By - Clifford M. (JavaFixing Volunteer)
