A CSRF token header is printed in logs but not available on the AEM instance; what should you configure?

A CSRF token header is printed in logs but not available on the AEM instance; what should you configure?

• A. Add the filter rule to allow the CSRF-Token header in the dispatcher configuration.
• B. Add header set CSRF-Token in the virtual host configuration.
• C. Add the clientheaders directive for CSRF-Token in the dispatcher configuration.
• D. Add X-Forwarded-Header in the virtual host configuration.

Answer: (C)

The header forwarding behavior is the key idea here. When a CSRF token is sent by the client, the Dispatcher in front of AEM may strip certain headers before passing the request to the AEM instance. If you see the CSRF-Token in logs but the AEM backend doesn’t receive it, Dispatcher isn’t forwarding that header to the origin. To fix this, configure Dispatcher to pass the CSRF-Token header through to AEM using the clientheaders setting in the dispatcher configuration. This tells Dispatcher to forward specific client headers to the backend. For example, adding a mapping for the CSRF-Token header ensures it travels from the client, through Dispatcher, to AEM, where it can be read and validated as part of CSRF protection. So you’d configure something like: /clientheaders { "CSRF-Token" "CSRF-Token" } This approach is correct because it directly controls which client headers reach the AEM instance, aligning Dispatcher behavior with the needs of CSRF protection. The other options either affect response headers rather than the request headers, or address headers in a way that doesn’t ensure the CSRF token reaches AEM, such as setting headers in the virtual host or using general header forwarding that doesn’t target the CSRF token.

The header forwarding behavior is the key idea here. When a CSRF token is sent by the client, the Dispatcher in front of AEM may strip certain headers before passing the request to the AEM instance. If you see the CSRF-Token in logs but the AEM backend doesn’t receive it, Dispatcher isn’t forwarding that header to the origin.

To fix this, configure Dispatcher to pass the CSRF-Token header through to AEM using the clientheaders setting in the dispatcher configuration. This tells Dispatcher to forward specific client headers to the backend. For example, adding a mapping for the CSRF-Token header ensures it travels from the client, through Dispatcher, to AEM, where it can be read and validated as part of CSRF protection.

So you’d configure something like:

/clientheaders

{

"CSRF-Token" "CSRF-Token"

}

This approach is correct because it directly controls which client headers reach the AEM instance, aligning Dispatcher behavior with the needs of CSRF protection. The other options either affect response headers rather than the request headers, or address headers in a way that doesn’t ensure the CSRF token reaches AEM, such as setting headers in the virtual host or using general header forwarding that doesn’t target the CSRF token.