Bad or missing CSRF

[Former Member]

I'm working on hybris 6.2, I'm trying to upload an image to my controller, but when I try to submit the form I am getting a 403 error message with the description "Bad or missing CSRF".

My form has the attribute enctype set to multipart/form-data..

 <form:form action="${url}" method="post" commandName="customUpdateProfileForm" id="customUpdateProfileForm" enctype="multipart/form-data">                    
     <table>
     <tr>
     <td>                        
         <input type="file" id="profilePicture" name="profilePicture" class="file-upload__input js-file-upload__input" accept=".png, .jpg, .jpeg" style="display:none" onchange="handleFiles(this.files)"/>            
         <button id="fileSelect" class="btn btn-link">Editar Foto de Perfil</button>
         <p><img src="${profile.profilePicture}"/></p>
         <div id="fileList"></div>
     </td>
     <td>
         <formElement:formSelectBox idKey="profile.title" labelKey="profile.title" path="titleCode" mandatory="true" skipBlank="false" skipBlankMessageKey="form.select.empty" items="${titleData}" selectCSSClass="form-control"/>
         <formElement:formInputBox idKey="profile.firstName" labelKey="profile.firstName" path="firstName" inputCSS="text" mandatory="true"/>
         <formElement:formInputBox idKey="profile.lastName" labelKey="profile.lastName" path="lastName" inputCSS="text" mandatory="true"/>
         <label class="control-label"><spring:theme code="profile.dob"/></label><br>
         <form:input idKey="profile.dob" labelKey="profile.dob" path="dob" type="date" mandatory="true"/>
     </td>
     </tr>
     </table>                      
     
     <div class="row">
         <div class="col-sm-6 col-sm-push-6">
             <div class="accountActions">
                 <ycommerce:testId code="personalDetails_savePersonalDetails_button">
                     <button type="submit" class="btn btn-primary btn-block">
                         <spring:theme code="text.account.profile.saveUpdates" text="Save Updates"/>
                     </button>
                 </ycommerce:testId>
             </div>
         </div>
         <div class="col-sm-6 col-sm-pull-6">
             <div class="accountActions">
                 <ycommerce:testId code="personalDetails_cancelPersonalDetails_button">
                     <button type="button" class="btn btn-default btn-block backToHome">
                         <spring:theme code="text.account.profile.cancel" text="Cancel"/>
                     </button>
                 </ycommerce:testId>
             </div>
         </div>
     </div>    
 </form:form>
             

and my form class has the image as a MultipartFile type:

 public class CustomUpdateProfileForm extends UpdateProfileForm {
     
     private String dob;
     private MultipartFile profilePicture;
 
     public String getDob() {
         return dob;
     }
 
     public void setDob(String dob) {
         this.dob = dob;
     }
 
     public MultipartFile getProfilePicture() {
         return profilePicture;
     }
 
     public void setProfilePicture(MultipartFile profilePicture) {
         this.profilePicture = profilePicture;
     }
 
 }

already tried a few solutions like disabling the CSRF feature,or adding my URL entry to the csrfAllowedUrlPatternsList, both options stopped that error, but after that in my controller the values of the form are always null, any idea on how to solve it?

[Former Member]

I'm not 100% sure what you're trying to do, but the CSRF validation is made in the CSRFHandlerInterceptor class. You can try customizing the "preHandle" method so Hybris doen't apresent error and always reaturn "true" (If that's what you want). Just be careful because CSRF validation can be very important security-wise.

[Former Member]

I want the upload an image, but whenever I try to submit the form, I'm getting the error I'm describing in my question.