Skip to main content
Jahia Store
EN

Jahia CSRF Guard

supported
Download 4.2.0

Information

Module ID
jahia-csrf-guard
Group ID
org.jahia.modules
Status
supported
Category
Security
Author
JSG
Developer website
http://www.jahia.com
Requires Jahia
8.1.7.0
Updated
2026-07-09
Source
scm:git:git@github.com:Jahia/jahia-csrf-guard.git
Tags
  • security

This module will add CSRF token protection on all calls to a Jahia Action. It's based on the OWASP CSRFGuard library.

Versions

4.2.0Download

Improvements

  • CSRF Guard is now disabled by default for unauthenticated users (guest). In most cases, CSRFGuard is not necessary when users are not authenticated, but if you need to change that behavior, it can be enabled using the jahia.csrf-guard.bypassForGuest property (true by default).
  • Updated the module to OWASP www-project-csrfguard v4.5.0 (latest version at the time of release). Notable changes include:
    • Improve URL normalization to allows URLs with protocol and server name
    • Introduced a tag mechanism to support client-side caching of jahia-csrf-guard's javascript
  • Replaced 'unload' event usage by 'pagehide' for registering cleanup operations, which helps improve pagespeed scores
  • Updated the module to use console.debug() instead of alert() to lower end-user disruptions

Misc

  • Removed unused dependency and upgraded jahia parent to 8.1.7.0
  • Removed Spring bean definition to migrate to OSGI including configuration 
  • Updated comments explaining usage of cacheControlTagged in csrfguard-jahia.properties file
Requires Jahia 8.1.7.0Updated 2025-05-12
4.1.0Download

Bug fixes

  • Fixed an issue with multi domain validation 
Requires Jahia 8.1.6.0Updated 2025-01-30
4.0.0Download

Breaking changes

  • No breaking changes are present in v4.0.0

Improvements

  • Activated CSRF TokenPerPage by default
  • Added current session's user in the logs
  • Improved filtering of actions (.do) by checking the end of the url

Bug fixes

  • Fixed an issue when calling Jahia actions related to a token not found
  • Fixed the domain check that was corrupted during minification
Requires Jahia 8.1.6.0Updated 2024-07-29
3.4.0Download

Improvements

  • Upgraded csrfguard to 4.3.0 to add support for multiple domain origin
Requires Jahia 8.0.3.0Updated 2023-06-15
3.3.0Download

Bug fixes

  • Improved the header check to prevent polluting errors in Chrome
Requires Jahia 8.0.3.0Updated 2023-03-24
3.2.0Download
In case you're using the Distributed Sessions module, please read the following:

If you are using the distributed-session module, you need to update it to version 3.4.0+ when updating to CSRF Guard 3.2.0, as CSRF Guard 3.2.0 is not compatible with distributed sessions 3.3. Both modules updates will require the restart of the cluster nodes. Note that jahia-csrf-guard 3.2.0 does not depend to distributed-session module anymore (since version 3.4.0)

Improvements

  • Updated the token holder to store the tokens in the session
  • Minified CSRFGuard template javascript to save space
Requires Jahia 8.0.3.0Updated 2022-11-16
3.1.0Download
In case you're using the Distributed Sessions module, please read the following:

Note that jahia-csrf-guard 3.0.0 & 3.1.0 have a hard dependency to at least version 3.3.0 of the distributed-session module. So you may need to upgrade also distributed-sessions. Both modules updates will require the restart of the cluster nodes. More details here.

Also note that as version 3.3.0 of the distributed-session module is only compatible with Jahia 8.1.0+, you cannot use jahia-csrf-guard 3.0.0 with Jahia versions prior to 8.1.0.

Bug fixes

  • Fixed possible truncated response when adding CSRF snippet
  • Made CSRFguard work with multipart content requests
Requires Jahia 8.0.3.0Updated 2022-11-16
3.0.0Download
  • Upgraded OWASP csrfguard from 3.1.0 to csrfguard 4.1.4
  • Allowed TokenPerPage to be configured (more details here)
Requires Jahia 8.0.3.0Updated 2022-06-23
2.4.0Download
  • Added possibility to set CSRFGuard properties (see Academy page)
  • Changed module-type of jahia-csrf-guard to "system"
  • Removed csrf token from error.html pages
Requires Jahia 8.0.0.0Updated 2022-03-11
2.3.0Download
  • Fixed issue with filtering not applied on SEO urls
Requires Jahia 8.0.0.0Updated 2021-11-04
2.2.0Download
  • Fixed incompatibility with IE11
Requires Jahia 8.0.0.0Updated 2021-06-17
2.1.0Download
  • Fixed actions being blocked due to not finding proper CSRFGuard token
Requires Jahia 8.0.0.0Updated 2021-02-05
2.0.0Download
  • Added CSRF tokens to secure the Core actions
Requires Jahia 8.0.0.0Updated 2020-09-04
1.5.0Download
  • Added possibility to set CSRFGuard properties (see Academy page)
  • Changed module-type of jahia-csrf-guard to "system"
  • Removed csrf token from error.html pages
Requires Jahia 7.2.3.1Updated 2022-03-10
1.4.0Download
  • Fixed issue with filtering not applied on SEO urls
Requires Jahia 7.2.3.1Updated 2021-10-05
1.3.0Download
  • Fixed CSRF guard module incompatibility with IE11
Requires Jahia 7.2.3.1Updated 2021-05-28
1.2.0Download
  • Fixed issue with CSRF Guard on Websphere by adding an alternative configuration
  • Fixed actions being blocked due to not finding proper CSRFGuard token
  • Fixed CSRFGuard to register the JavaScriptServlet as servlet (Websphere)
Requires Jahia 7.2.3.1Updated 2021-02-22
1.1.1Download
  • Fixed issue on Websphere by adding an alternative configuration
Requires Jahia 7.2.3.1Updated 2020-10-01
1.1.0Download

Jahia CSRF Guard module for Jahia 7.x

Requires Jahia 7.2.3.1Updated 2020-09-29