Search code examples
javascriptjavajspcsrfcsrf-token

csrf token per page - java.lang.IllegalStateException: must define 'uri' attribute when token per page is enabled

I am trying to enable the token par page from CsrfGuard.properties. but after deploying while I am trying to access the URL I am getting a 500 error because it's throwing below exception.

Can you please help me to fix this? Where do I need to pass/define this URI?

CsrfGuard.properties

org.owasp.csrfguard.TokenPerPage=true
org.owasp.csrfguard.TokenPerPagePrecreated=true

JSP Page:

<form name="test">
.....
     <input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value/>"/>
</form>

Exception:

java.lang.IllegalStateException: must define 'uri' attribute when token per page is enabled
Solution

  • It need to be added part of token value t tag,

    <input type="hidden" name="<csrf:token-name/>" value="<csrf:token-value uri='page.jsp' />"/>