Search code examples
strutscsrfowasp

OWASP CsrfGuard token missing while submitting multipart formdata

I have implemented OWASP CsrfGuard 3 filter on an existing Struts 1.1 application, its working fine for every request, except the forms which have a file upload field and enctype="multipart/form-data". The following message is logged on the console "error:required token is missing from the request".

The csrf token was added as a hidden field on the form, and is present when I view the page source in the browser.

The form works fine if I remove the file field from the form and enctype attribute from html:Form tag.

Please let me know how to configure mulipart file upload with CsrfGuard.

Thanks,

Solution

  • Sorry that's a known issue (See the CSRF mailing list, April 2011).