Page 1 of 1

XSRF token mismatch (null). Session may be expired.

Posted: Tue Jan 01, 2013 8:58 pm
by mota_nginya
Ok Maestros,

I have been making some progress with the demo project which I think is awesome and gives the perfect headstart f or anyone in this business who is trying a make a living by putting together an ecommerce application either for private use or for a company. So, before I proceed, permit to extend a million thanks to the broadleaf team for giving us java-spring folks a great option. [The most mature open source e-commerce framework ever period]

This are some of the issues I am facing now and would gladly appreciate if someone with inside knowledge can step in and help-out.

1. I am running 2.20-SNAPSHOP and Yes I know this is living on the edge because it is not a Master but I think it is more current. If nothing else it has the admin and site combined which makes it easier to deploy and maintain.

2. I had the authorize.net test account setup to use for testing the site as described by the instructions on the advance quick start pages. I ran into issue where on startup it failed with an error that it could not find "blAuthorizeNetCheckoutService" which I fixed by adding it also as a bean in the applicationContext. Oh and that occurred because I changed CheckoutController to extend BroadleafAuthorizeNetController instead of BroadleafCheckoutController and added this method to handle call from authorize.net after receiving a direct post from the paymentInfoForm that I also got from http://docs.broadleafcommerce.org/current/Authorize.net-Quick-Start.html.

Code: Select all

     //This is the URL that Authorize.net will call after receiving a Direct Post from a payment
    //This should match ${authorizenet.relay.response.url} in your properties file.
    @RequestMapping(value = "/process", method = RequestMethod.POST, produces = "text/html")
    public @ResponseBody String processAuthorizeNetAuthorizeAndDebit(HttpServletRequest request,     
            HttpServletResponse response, Model model) throws NoSuchAlgorithmException, UnsupportedEncodingException, PricingException, InvalidKeyException {
        return super.processAuthorizeNetAuthorizeAndDebit(request, response, model);
    }


But when I did that I ran into another issue where when I clicked the use shipping address checkbox, the paymentInfoForm was not populated. So I edited the jquery function that handles that request to solve that problem.

After all was done and also made sure my local.properties file has correct authorize.net configuration instruction so that my request can connect to the authorize.net server, I ran into this exception:

Code: Select all

org.broadleafcommerce.common.exception.ServiceException: XSRF token mismatch (null). Session may be expired.
   at org.broadleafcommerce.common.security.service.ExploitProtectionServiceImpl.compareToken(ExploitProtectionServiceImpl.java:126)
   at org.broadleafcommerce.common.security.handler.CsrfFilter.doFilter(CsrfFilter.java:77)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
   at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:166)
   at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
   at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
   at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)
   at org.broadleafcommerce.common.web.BroadleafRequestFilter.doFilterInternal(BroadleafRequestFilter.java:152)
   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter.doFilterInternal(OpenEntityManagerInViewFilter.java:147)
   at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
   at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
   at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
   at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
   at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
   at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
   at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
   at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:448)
   at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)
   at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
   at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)
   at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1067)
   at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:377)
   at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:192)
   at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1001)
   at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
   at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:250)
   at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149)
   at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111)
   at org.eclipse.jetty.server.Server.handle(Server.java:360)
   at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:454)
   at org.eclipse.jetty.server.AbstractHttpConnection.content(AbstractHttpConnection.java:900)
   at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:954)
   at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:851)
   at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
   at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:77)
   at org.eclipse.jetty.io.nio.SslConnection.handle(SslConnection.java:191)
   at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:622)
   at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:46)
   at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:603)
   at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:538)
   at java.lang.Thread.run(Thread.java:680)


Am I missing something, can someone please help me out with this?

Re: XSRF token mismatch (null). Session may be expired.

Posted: Wed Jan 02, 2013 12:41 pm
by phillipuniverse
You need to exclude your Authorize.net process URL from the CsrfFilter since it POSTs to your application. This was not referenced in the docs previously, but I just added it. You'll see it as the last point (#4) on this page: http://docs.broadleafcommerce.org/curre ... Start.html

Re: XSRF token mismatch (null). Session may be expired.

Posted: Tue Jan 22, 2013 11:32 am
by skala
I have followed through all steps but get stack trace when authorize.net tries to contact my server back. Please help me try to resolve this, it is highly appreciated.

I used https://forwardhq.com to create public tunnel to localhost:8080. This gives me a url like https://mydummycomp.fwd.wf. When i access this, it takes me to http://localhost:8080 and I can see DemoSite home page perfectly. This is what my .properties file look like

*.properties file

Code: Select all

authorizenet.api.login.id=**********
authorizenet.transaction.key=*************
authorizenet.merchant.md5.key=12345
authorizenet.relay.response.url=https://mydummycomp.fwd.wf/authorizenet/process
authorizenet.confirm.url=https://mydummycomp.fwd.wf/confirmation
authorizenet.error.url=https://mydummycomp.fwd.wf/authorizenet/error
authorizenet.server.url=https://test.authorize.net/gateway/transact.dll
authorizenet.x_test_request=FALSE


After successful payment processing, authrorize.net displays below message on my web page and throws exception on my sever. This means call to and from authorize.net was successful but call back to my server is misconfigured to some inaccessible page.

URL where response lands up : https://test.authorize.net/gateway/transact.dll
Message on the response page:
An error occurred while trying to report this transaction to the merchant. An e-mail has been sent to the merchant informing them of the error. The following is the result of the attempt to charge your credit card.

This transaction has been approved.

It is advisable for you to contact the merchant to verify that you will receive the product or service.


Exception on my jetty server:

Code: Select all

.. WARN:oejs.ServletHandler:/authorizenet/process
[artifact:mvn] org.broadleafcommerce.common.exception.ServiceException: XSRF token mismatch (null). Session may be expired.
[artifact:mvn]    at org.broadleafcommerce.common.security.service.ExploitProtectionServiceImpl.compareToken(ExploitProtectionServiceImpl.java:107)
[artifact:mvn]    at org.broadleafcommerce.common.security.handler.CsrfFilter.doFilter(CsrfFilter.java:77)
[artifact:mvn]    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
[artifact:mvn]    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:105)
[artifact:mvn]    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
[artifact:mvn]    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
[artifact:mvn]    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
[artifact:mvn]    at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144)
[artifact:mvn]    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:323)
[artifact:mvn]    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:173)
[artifact:mvn]    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
[artifact:mvn]    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
[artifact:mvn]    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
[artifact:mvn]    at org.broadleafcommerce.common.web.BroadleafRequestFilter.doFilterInternal(BroadleafRequestFilter.java:146)
[artifact:mvn]    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
[artifact:mvn]    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
[artifact:mvn]    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
[artifact:mvn]    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
[artifact:mvn]    at org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter.doFilterInternal(OpenEntityManagerInViewFilter.java:147)
[artifact:mvn]    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
[artifact:mvn]    at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1302)
[artifact:mvn]    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:448)
[artifact:mvn]    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)
[artifact:mvn]    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
[artifact:mvn]    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)
[artifact:mvn]    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1067)
[artifact:mvn]    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:377)
[artifact:mvn]    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:192)
[artifact:mvn]    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1001)
[artifact:mvn]    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
[artifact:mvn]    at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:250)
[artifact:mvn]    at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149)
[artifact:mvn]    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111)
[artifact:mvn]    at org.eclipse.jetty.server.Server.handle(Server.java:360)
[artifact:mvn]    at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:454)
[artifact:mvn]    at org.eclipse.jetty.server.AbstractHttpConnection.content(AbstractHttpConnection.java:900)
[artifact:mvn]    at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.content(AbstractHttpConnection.java:954)
[artifact:mvn]    at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:851)
[artifact:mvn]    at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
[artifact:mvn]    at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:77)
[artifact:mvn]    at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:622)
[artifact:mvn]    at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:46)
[artifact:mvn]    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:603)
[artifact:mvn]    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:538)
[artifact:mvn]    at java.lang.Thread.run(Thread.java:680)[/size]

Re: XSRF token mismatch (null). Session may be expired.

Posted: Tue Jan 22, 2013 12:30 pm
by phillipuniverse
Did you exclude the process url from the CSRF filter that I posted in the reply?

Re: XSRF token mismatch (null). Session may be expired.

Posted: Tue Jan 22, 2013 12:41 pm
by skala
Yes I did. Also I am using 2.0.2-GA for broadleaf-authorizenet.

Thanks for your prompt reply!

Re: XSRF token mismatch (null). Session may be expired.

Posted: Tue Jan 22, 2013 3:25 pm
by phillipuniverse
Set a breakpoint in CsrfFilter.java and see what is in the list of excluded URLs. If you included /authorizenet/process in the list correctly, you should see it when you debug.

Re: XSRF token mismatch (null). Session may be expired.

Posted: Thu Jan 24, 2013 5:50 pm
by skala
Yes it works. Thanks!!

Re: XSRF token mismatch (null). Session may be expired.

Posted: Thu Jul 06, 2017 10:24 am
by ash
Hello,

I am getting a exception when I am trying to test a REST sevice API.Can anyone please help me.

Below is my exception.
javax.servlet.ServletException: org.broadleafcommerce.common.exception.ServiceException: XSRF token mismatch (277B-HZD8-4IVF-UJ4G-ADOQ-4087-IYH8-DC5X). Session may be expired.

Re: XSRF token mismatch (null). Session may be expired.

Posted: Thu Jul 06, 2017 10:24 am
by ash
javax.servlet.ServletException: org.broadleafcommerce.common.exception.ServiceException: XSRF token mismatch (277B-HZD8-4IVF-UJ4G-ADOQ-4087-IYH8-DC5X). Session may be expired.