#form_xsrfToken() doesnt get rendered

Confluence Development Confluence Server
, ,
#1

Hi!

I am working on a Confluence plugin which uses a rest resource to upload a file to Confluence via a HTML Form in a vm file, which is loaded from within a servlet using TemplateRenderer.

because I am receiving “XSRF check failed” when I call my rest funtion (POST) after submitting the HTML form, I found via google that I should use #form_xsrfToken() macro within my HTML Form.

Unfortunately this doesnt get rendered, it appears in the text …

any Help with this would be greatly appreciated!

Thanx in advance,
Hans

#2

Post code responsible for showing the form at first place along with respective part of atlassian xml.
Is that an action that extends the ConfluenceActionSupport?
If macro appears as is, it means that is unknown/null, check spelling.

#3

HI!

atlassian-plugin.xml:

<web-resource key=“scontent2-resources” name=“scontent2 Web Resources”>
<dependency>com.atlassian.auiplugin:ajs</dependency>
<resource type=“download” name=“scontent2.css” location="/css/scontent2.css"/>
<resource type=“download” name=“scontent2.js” location="/js/scontent2.js"/>
<resource type=“download” name=“images/” location="/images"/>
<context>scontent2</context>
</web-resource>

<servlet name=“Config Servlet” i18n-name-key=“config-servlet.name” key=“config-servlet” class=“com.mycompany.plugins.servlet.ConfigServlet”>
<description key=“config-servlet.description”>The Config Servlet Plugin</description>
<url-pattern>/scontent</url-pattern>
</servlet>

com.mycompany.plugins.servlet.ConfigServlet:

@Named (“ConfigServlet”)
public class ConfigServlet extends HttpServlet{

private static final Logger log = LoggerFactory.getLogger(ConfigServlet.class);

@ComponentImport
private final TemplateRenderer templateRenderer;

@ComponentImport
private final PageBuilderService pageBuilderService;

@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
{

pageBuilderService.assembler().resources().requireWebResource(“com.mycompany.plugins.scontent2:scontent2-resources”);
resp.setContentType(“text/html”);
templateRenderer.render(“templates/main.vm”, resp.getWriter());
}
}

templates/main.vm

&lt;form id="scBannerForm" method="POST" enctype="multipart/form-data" action="/confluence/rest/upload/1.0/file/banner" class="aui"&gt;
	#form_xsrfToken()

…
…
</form>

Thanx & reagrds,
Hans

#4

I dont thinkbyou can use the form macro from servlet unless you inject the xsrftokengenerator and generate token than you the validate. Switch servlet to action and hour problem will magically dissappear

#5

Hi!

I think so too.

Thank You for Your very valid and appreciated input!

regards,
Hans

#6

Typing from mobile is ugly. I am glad it makes sense :slight_smile:

#7

Hi Panos!

guess what happened:

I created a XWork Action which loads the .vm which incorporates the #form_xsrfToken macro and the result is the same:

The macro now isnt showed in the text anymore, but there stil is “XSRF_CHECK failed” …

The log shows:

[common.security.jersey.XsrfResourceFilter] passesAllXsrfChecks XSRF checks failed for request: http://myurl:1990/rest/upload/1.0/file/banner , origin: null , referrer: null

any idea about that ?

Thanx & Regrads,
Hans

#8

Please read this one https://developer.atlassian.com/confdev/confluence-plugin-guide/writing-confluence-plugins/form-token-handling

#9

Hi!

The only way I got it working was to use a custom JS Form submit function which uses ajax to do the REST call and providing the appropriate header “X-Atlassian-Token: no-check”

regards,
Hans