topic Re: Alfresco cookie Alfresco-CSRF Token in Alfresco Forum

Alfresco cookie Alfresco-CSRF Token

cco — Tue, 18 Apr 2017 10:19:17 GMT

Hi all,I am using JMeter (v2.9) to test performance of application based on Alfresco(v5.0.3).I can not get cookie Alfresco-CSRF Token.By viewing request in Firefox tools, Alfresco-CSRF Token is given in the Response Header in the request GET /share/page following the request POST /share/page/login.W

Re: Alfresco cookie Alfresco-CSRF Token

mehe — Tue, 18 Apr 2017 16:49:58 GMT

Hi,

not sure if missed something in your description - the client, in your case jmeter, must have a mechanism to receive and store the cookies. Is your jmeter cookie manager enabled and have set CookieManager.save.cookies=true?

Did you follow articles that describe jmeters use in the context of CSRF protection (i.e. How to Load Test CSRF-Protected Web Sites | BlazeMeter )?

or tried to just turn off or configure the Alfresco CSRF protection temporarily? Cross-Site Request Forgery (CSRF) filters | Alfresco Documentation

Re: Alfresco cookie Alfresco-CSRF Token

cco — Wed, 19 Apr 2017 08:09:35 GMT

Hi Martin,

In Jmeter, Cookie Manager is used. But unfortunaly, no cookie CSRF was present in response header. So no parsing was possible.

The problem was that 3 servers ECM, SHARE and SolR sent your own header and i got JSESSIONID cookie instead of CSRF cookie.

It was resolved by changing apache configuration.

Re: Alfresco cookie Alfresco-CSRF Token

afaust — Wed, 19 Apr 2017 08:24:04 GMT

The GET on /share/page should redirect you with a 302 response to the actual starting page, normally the user dashboard. The GET for the user dashboard should then provide you with the CSRF token, as these are generated on each page rendition request.

Re: Alfresco cookie Alfresco-CSRF Token

mehe — Wed, 19 Apr 2017 08:27:58 GMT

Sorry bothering you with the basic stuff, but it's sometimes hard to see how deep the analysis of the problem went before glad to hear you've got it working

Re: Alfresco cookie Alfresco-CSRF Token

href — Thu, 17 Oct 2024 11:35:33 GMT

Hi @cco ,

I have same problem. Can you tell please what kind of configuration was done in apache file?