Is there any change in CSRF token structure or flow from Hybris 6.0 to Hybris 6.6?

[Former Member]

I recently upgraded from Hybris 6.0 to Hybris 6.6. I am trying to POST a request from storefront, but its throwing error as 405 in server. The tomcat access log has the entry but in error as "405: Method not allowed". I assume it is a CSRF token issue but I am unable to fix it anyhow. I am sending the CSRFToken along with the POST request, but somehow its not working.

Can anyone help on this?

Thanks

[Former Member]

Hi, There is a significant change in Hybris 6.6 for "security:csrf disabled="true"", and they have removed the CSRFHandlerInterceptor as well. Try checking the existing yacceleratorstorefront, spring-security-config.xml , below is the code snippet.

security:csrf token-repository-ref="csrfTokenRepository" request-matcher-ref="csrfProtectionMatcher".

After adding it, I'm not getting 405 error on Post form submission, but I'm still getting a 404 in response. If you are able to resolve, pls do share your findings.

Many Thanks!

[ishan_sap]

Did it work for you?