Getting XSRF error when making POST REST call from dialog

Tom Hudgins_rj2611

I'm using Scriptrunner to implement a pop-up dialog in a ticket using a fragment and a Scriptrunner REST endpoint. The dialog contains an html form that then sends its data to another Scriptrunner REST endpoint for processing of the data in the form.

This all works fine if the form does a GET to send its data to the second endpoint. However, if I make the second endpoint a POST endpoint and POST the form data to it, I get an XSRF error in my browser and it doesn't work. I can send the POST request from say, Postman directly and that works fine.

I see lots of posts from people having this or a similar issue and the solution seems to hinge on setting specific headers in the POST call. It's unclear to me exactly what the solution is and how to accomplish this in my situation because I'm just doing an HTML form POST and I don't really have access to setting headers and such. 

Thanks for any insight

Tom Hudgins_rj2611

I wanted to follow-up on my own post because I've gotten a full/clear solution with the help of Adaptavist Support. They helped me get a security token embedded in the form data with this code (snippet)

import com.atlassian.jira.component.ComponentAccessor
import com.atlassian.jira.security.xsrf.XsrfTokenGenerator

... 
 XsrfTokenGenerator xsrfTokenGenerator = ComponentAccessor.getComponentOfType(XsrfTokenGenerator.class)
 String atl_token = xsrfTokenGenerator.generateToken(request)
... 

                input(type:"hidden", name:"atl_token", value:"${atl_token}")

With that hidden field, I got past the XSRF error when the form was POSTED back to another Scriptrunner REST endpoint. 

Then, in that endpoint, it was just a matter of reading the field values from the Map in the HttpServletRequest parameter. 

Hope this helps someone else.