Problem/Motivation

When anonymous users are trying to upload via DropzoneJS, an access denied exception is thrown.
I'm using this in combination with webform_dropzonejs to let anonymous users upload documents.

Path: /nl/dropzonejs/upload?token=cNJv8hT1jZdmtk6XCAWtGm3jmoaH3ILoCUQFACwxrqA. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: 'csrf_token' URL query argument is invalid. in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 120 of /data/sites/web/xxxxx/production/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).

Should we also allow uploads without csrf-token to allow anonymous uploads?

CommentFileSizeAuthor
#2 dropzonejs-3197207-2.patch350 bytesstijnstroobants

Comments

StijnStroobants created an issue. See original summary.

stijnstroobants’s picture

stijnstroobants
Primary language Dutch
Location Leuven
commented
StatusFileSize
new dropzonejs-3197207-2.patch350 bytes

I know this is probably not the best solution, but I removed the csrf access check in the routing.yml file.
csrf-tokens will not work for anonymous users.

nwom’s picture

nwom commented
Status: Active » Needs review

Setting to Needs Review, since a patch is attached. I have not tested it, but ran into the issue while looking for something else.

Status: Needs review » Needs work

The last submitted patch, 2: dropzonejs-3197207-2.patch, failed testing. View results

kazah’s picture

kazah commented

Are there any progress?

weseze’s picture

weseze commented

Seems like a security issue to remove the CSRF token?

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

I have a use case for this, we need to accept anonymous uploads and the way we're doing this somehow core doesn't like it. There's either the above patch or the core patch.
see #3316184: Sessionless users have no CSRF token - use 2.5.0 instead of 2.7.0

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

The above patch is working for anonymous uploads (a valid use case we are using).

I've triggered a few new test runs in comment# 2.

aherczeg’s picture

aherczeg commented

Patch in #2 solves the issue for us.