Hi,
I checked the ajax url and there was no p_auth or p_p_auth parameter in the url. But I also checked a "normal" request (with page reload), there was automatically a p_p_auth token in the URL.
The token you see (p_p_auth) is a different one.
Can this also be configured for ajax calls?
Init of the serveResource URL:
Resource serving requests are not checked for CSRF token currently and there is no portal-wide configuration for it.
You can implement the check by yourself, example:
public void serveResource(ResourceRequest resourceRequest, ResourceResponse resourceResponse) throws IOException, PortletException {
HttpServletRequest request = PortalUtil.getOriginalServletRequest(PortalUtil.getHttpServletRequest(resourceRequest));
try {
// Liferay 6.2:
AuthTokenUtil.checkCSRFToken(request, this.getClass().getName());
// Liferay 6.1:
// AuthTokenUtil.check(request);
} catch (Exception e) {
throw new PortletException("Invalid CSRF token!", e);
}
//... your code continues here
}
With this check you need to add the p_auth into the Ajax call, for example:
$.ajax({type: "POST",
url: globalResourceUrl,
data: {
cmd: "validateURL",
feedURL : urlValue,
p_auth: Liferay.authToken
}
}).done(function( data ) {
...
}
HTH
