The CSRF Protection Framework

Last update: July 22, 2024

CREATED FOR:

  • Developer

In addition to the Apache Sling Referrer Filter, Adobe also provides a new CSRF Protection Framework to protect against this type of attack.

The framework makes use of tokens to guarantee that the client request is legitimate. The tokens are generated when the form is sent to the client and validated when the form is sent back to the server.

NOTE
There are no tokens on the publish instances for anonymous users.

Requirements

Dependencies

Any component that relies on the granite.jquery dependency can benefit from the CSRF Protection Framework automatically. If not, for any of your components, you must declare a dependency to granite.csrf.standalone before you can use the framework.

Replicating the Crypto Key

To use the tokens, you need to replicate the HMAC binary to all the instances in your deployment. See Replicating the HMAC key for more details.

NOTE
Make sure you also make the necessary Dispatcher configuration changes to use the CSRF Protection Framework:
NOTE
If you use the manifest cache with your web application, make sure you add “*” to the manifest to make sure the token does not take the CSRF token generation call offline. For more information, consult this link.
For more information on CSRF attacks and ways to mitigate them, see the Cross-Site Request Forgery OWASP page.

Experience Manager


Put the Customer at the Center and Build Relationships That Last a Lifetime

Online | Strategy Keynote | General Audience

First impressions last a lifetime. Great first impressions feel personal, connected, and relevant right from the start. From the first...

Wed, Mar 19, 2:30 PM PDT (9:30 PM UTC)

Register

How EY Enhanced Regulatory Knowledge Management with Adobe Solutions

Online | Session | General Audience

Delve into how EY leverages Adobe solutions to enhance regulatory knowledge management. EY leverages search analytics and personalization...

Wed, Mar 19, 4:00 PM PDT (11:00 PM UTC)

Register

Connect with Experience League at Summit!

Get front-row access to top sessions, hands-on activities, and networking—wherever you are!

Learn more

Register now