Spring CSRF token does not work, when the request to be sent is a multipart request

Question

I use,

• Spring Framework 4.0.0 RELEASE (GA)
• Spring Security 3.2.0 RELEASE (GA)
• Struts 2.3.16

In which, I use an in-built securi

Answer 1

I solved this problem by:

• sending the multi-part file using vanilla javascript, like in Mozilla's guide
• adding the _csrf token in the HTML header, in meta tags, like in the Spring guideline for sending the CSRF token with Ajax

• instead of using jquery, adding it directly to the XHR object

  var csrfToken = $("meta[name='_csrf']").attr("content");
  var csrfHeader = $("meta[name='_csrf_header']").attr("content");
  XHR.setRequestHeader(csrfHeader, csrfToken);
  XHR.setRequestHeader('Content-Type','multipart/form-data; boundary=' + boundary);
  
  XHR.send(data);