CODEWITHSUNDEEP
angularjsplayframeworkcsrf
FreeMan
FreeMan

Reputation: 1457

Not working with json but working with urlencoding in Postman

I am stuck, I spent almost whole day to solve this problem. I am trying to integrate csrf security to our website that is written with play framework 2.5.9 and angularjs 1.x. I added csrf things and I tried to test via postman. While it works as content-type is set to x-www-form-urlencoded however not working when it is set to application/json. It gives me 

Content-Length →0
Date →Tue, 14 Mar 2017 13:22:13 GMT
error →No CSRF token found for application/json body

and my json is 

{
    "username": "admin", 
    "email": "admin", 
    "password": "123456", 
    "consumer": "consumer",
    "csrfToken": "c29625a2c1c26bfbd4e74f6f6499d21f9a21aed-1489470934941-ae012aab7984ed13bfc697ea"
}

what's wrong with it? Do I miss something? Any help, appreciated.

EDIT: By the way, when I disable csrf check in application.conf by adding following lines

X-Requested-With = "*"
Csrf-Token = "nocheck"

post method works for application/json content-type.

Upvotes: 1

Views: 706

Answers (1)

Andriy Kuba
Andriy Kuba

Reputation: 8263

Play default CSRF protection filter check the

  1. Query string
  2. Header
  3. application/x-www-form-urlencoded content type
  4. multipart/form-data content type

You can check the source:

https://github.com/playframework/playframework/blob/master/framework/src/play-filters-helpers/src/main/scala/play/filters/csrf/CSRFActions.scala#L425

https://github.com/playframework/playframework/blob/master/framework/src/play-filters-helpers/src/main/scala/play/filters/csrf/CSRFActions.scala#L66

https://github.com/playframework/playframework/blob/master/framework/src/play-filters-helpers/src/main/scala/play/filters/csrf/CSRFActions.scala#L90

So what you can do:

  1. Add csrfToken to the query string ...?csrfToken=...(not recommended)
  2. Add crfToken to the headers
  3. Disable it
  4. Write your own CSRF filter

Upvotes: 2

Related Questions