Spring Security - CSRF implementation through EXTJs

[Rahul Ba]

I am trying to implement CSRF implementation through EXTJs. I can see below are the steps. That's it. There is no need for CSRF token validation code. I assume Spring automatically takes care of it.
Is there anything need to done further?


2. We need add below dependency

	<!-- Spring Security -->
	<dependency>
		<groupId>org.springframework.security</groupId>
		<artifactId>spring-security-web</artifactId>
		<version>${spring.security.version}</version>
	</dependency>

	<dependency>
		<groupId>org.springframework.security</groupId>
		<artifactId>spring-security-config</artifactId>
		<version>${spring.security.version}</version>
	</dependency>

		<!-- jstl for jsp page -->
		<dependency>
			<groupId>jstl</groupId>
			<artifactId>jstl</artifactId>
			<version>${jstl.version}</version>
		</dependency>

3. Get the values in Html page

	<meta name="_csrf" content="${_csrf.token}"/>
	<meta name="_csrf_header" content="${_csrf.headerName}"/>

4. Send the requests in all requests

 beforeSend : function(xhr) {
              xhr.setRequestHeader("X-XSRF-TOKEN", csrftoken);
        }

[Gautam s verma]

Hi, I am trying to achieve the same thing my environment: EXTJS 6.5 application inside spring-boot application for UI, I have separate Authorization server, and a separate Resource server. but I do not know how to get the values in <meta name="_csrf" content="${_csrf.token}"/>
<meta name="_csrf_header" content="${_csrf.headerName}"/> tags. the catch is I am not using servlet, infact only EXTjs application. can any one give me a little direction how to populate the csrf values in extjs application ?  any suggestion will be appreciated.  

[Gaurav Kalal]

I was able to do it as follows. Add below snippet to your app.js or Application.js of ext js application.


Ext.Ajax.on('beforerequest', function(conn, options) {
    var x = document.getElementsByTagName("META");
    var token = "";
    var headerVal = ""; 
    var i;
    for (i = 0; i < x.length; i++) {
        if (x[i].name == "_csrf")
        {
             token = x[i].content;
        }else if (x[i].name=="_csrf_header"){
             headerVal = x[i].content;
        }
    }

    Ext.Ajax.setDefaultHeaders({
        headerVal : token
    });
});