CSRF Protection

To prevent CSRF attacks, the BPC generates a CSRF token for the user every time they log in. This token must be transmitted with every API call (except GET calls) via the HTTP header ` X-Csrf-Token ` or the URL parameter ` X-Csrf-Token`.

The BPC automatically adds this to AJAX calls via the ExtJS framework.

Manually setting the CSRF token

If AJAX calls are not made via ExtJS, the header can be set manually.

The API function BpcCommon.Api.getCsrfToken() returns an object that contains the required token in the X-Csrf-Token attribute.

Example of setting the CSRF header in a vanilla JavaScript AJAX call

function reqListener () {
    console.log(this.responseText);
}

const req = new XMLHttpRequest();
req.addEventListener("load", reqListener);
req.open("POST", "cxf/bpc-httpproxy/httpProxy/1647604124866");
req.setRequestHeader(
    "X-Csrf-Token",
    BpcCommon.Api.getCsrfToken()["X-Csrf-Token"]
  );
req.send();

Preventing the automatic CSRF token

If you do not want the BPC to automatically include the CSRF token, this can be achieved in the connection parameters using the flag disableBpcProcessing: true.

Example

  Ext.create("Ext.data.Store", {
    proxy : {
         type        : "ajax",
         url         : "/url",
         extraParams : {
            disableBpcProcessing : true
         }
    }
});

Keywords: