CSRF token mismatch in 6.6

[Former Member]

Hi all,

We are upgrading 6.0 to 6.6. On submitting a post request in 6.6, CSRF token was generated as org.springframework.security.web.csrf.DefaultCsrfToken@3f7d8dec. Please suggest, does the generated CSRF format correct?

on other side, I could see the generated CSRF token was compared with csrfToken.getToken() as below. On inspecting, value shown for csrfToken.getToken() as b9ef5846-ed23-4e73-bef1-40450a837c29.

actualToken = org.springframework.security.web.csrf.DefaultCsrfToken@3f7d8dec
csrfToken.getToken()= b9ef5846-ed23-4e73-bef1-40450a837c29

if(!csrfToken.getToken().equals(actualToken)) {

}

Above snippet of code is taken from CsrfFilter class. With above condition, its redirecting to /login page and returning 302 status code.

We have already included in security xml. Anybody can help us, how tokens are mismatch on comparing.

[Former Member]

CSRFTokenManager is deprecated and now hybris is using CsrfFilter from spring. You need to make changes to start using CSRFRequestDataValueProcessor which uses a tokenRepository.

All you need is probably a cleanup of the deprecated csrf handling and things will start working