CSRF Token for Platform

Activation To activate CSRF Token verification, use the following configuration: <extension target= "org.nuxeo.runtime.ConfigurationService" point= "configuration" > <property name= "nuxeo.csrf.token.enabled" > true </property> </extension> When this is activated, all clients accessing Nuxeo will need to get a token and provide it on all requests that are not GET/HEAD. Note that even when the CSRF Token is not activated, other CSRF checks not using a token are still being done (using the Origin/Referer headers). Getting the token initially The client must use the following request with the header CSRF-Token: fetch : GET /nuxeo CSRF-Token: fetch The response will contain the token in the header: 200 OK CSRF-Token: uNTIwv3oEImb3singqJKSuJDNjM9ldVOjnwtxmFh Passing the token Then on every request that is not a GET/HEAD (so this applies to POST/PUT/DELETE/etc.) the client must provide the same token, either in the CSRF-Token request header or in the csrf-token request parameter: POST /nuxeo/something CSRF-Token: uNTIwv3oEImb3singqJKSuJDNjM9ldVOjnwtxmFh or POST /nuxeo/something?csrf-token=uNTIwv3oEImb3singqJKSuJDNjM9ldVOjnwtxmFh Missing, expired or invalid token If the token is missing, expired or invalid, the client will get a 403 Forbidden error, and a CSRF-Token: invalid header will be set: 403 Forbidden CSRF-Token: invalid Skipping certain endpoints Some authentication endpoints need to be available with a POST without CSRF token checks. This can be done using for example: <extension target= "org.nuxeo.runtime.ConfigurationService" point= "configuration" > <property name= "nuxeo.csrf.token.skip" list= "true" > /login </property> </extension>