3

I am having this issue where I am able to display a Page using Spring MVC Controller

@RequestMapping(value = "/example/user", method = RequestMethod.GET)
public ModelAndView showForm() {
    System.out.println("#############Hellooo I was here#################");
    return new ModelAndView("user", "user", new UserForm());
}

This is displaying a user.jsp as expected. Now from this User.Jsp I am submitting a form which is like this 

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form"%>
<html>
    <head>
    </head>
    <body>
        <h3>Welcome, Enter The Employee Details</h3>
        <form:form method="POST" action="/example/userdetails" modelAttribute="user">
             <table>
                <tr>
                    <td><form:label path="firstName">Name</form:label></td>
                    <td><form:input path="firstName"/></td>
                </tr>
                 <tr>
                    <td><form:label path="email">Email</form:label></td>
                    <td><form:input path="email"/></td>
                </tr>
                <tr>
                    <td><input type="submit" value="Submit"/></td>
                </tr>
            </table>
        </form:form>
    </body>
</html>

Upon submission I was expecting this page to display another page but I keep getting this error

HTTP Status 403 -

type Status report

message

description Access to the specified resource has been forbidden.

Apache Tomcat/8.0.39

For some reason the control doesn't seem to be going to this method

@RequestMapping(value = "/example/userdetails", method = RequestMethod.POST)
public String submit(@ModelAttribute("user")UserForm user, BindingResult result, ModelMap model) {
    System.out.println("#############Hellooo I was here ->submit#################");
    if (result.hasErrors()) {
        return "error";
    }
    model.addAttribute("firstName", user.getFirstName());
    model.addAttribute("email", user.getEmail());
    return "view";
}

Do with DXA/Tridion web app we need to do some settings to enable Post operations? As Get seems to be working fine.

Improve this question
2

1 Answer 1

Reset to default
3

Got it working.

Basically, It seems that forms in DXA need to be tied to csrf-token. So inside your form include this tag 

    <dxa:csrf-token/>

to something like 

 <form method="POST" action="/example/userdetails" >
    <dxa:csrf-token/>
         <table>
            <tr>
                <td><label path="firstName">Name</label></td>
                <td><input path="name"/></td>
            </tr>....

Hope the Documentation was explicitly stating that CSRF Token is required for all post operations. (I could have avoided 2 days of frustration :P)

Improve this answer
2
  • The docs do mention how to disable CSRF protection (obviously not recommended): docs.sdl.com/LiveContent/content/en-US/SDL%20DXA-v7/…
    – Rick Pannekoek
    Commented Jul 14, 2017 at 8:24
  • +1 Abhishek. The right thing to do is to submit the csrf token, not disable the protection as per the docs. I too wish the recommended approach was provided in the docs. There used to be a way to leave comments in the docs, but I don't see that option enabled anymore.
    – Nickoli Roussakov
    Commented Oct 6, 2017 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.