{"action":"created","issue":{"url":"https://api.github.com/repos/hdiv/hdiv/issues/83","labels_url":"https://api.github.com/repos/hdiv/hdiv/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/hdiv/hdiv/issues/83/comments","events_url":"https://api.github.com/repos/hdiv/hdiv/issues/83/events","html_url":"https://github.com/hdiv/hdiv/issues/83","id":105451187,"number":83,"title":"Adding HDIV State ID while making AJAX calls","user":{"login":"prashathsenthil","id":3372529,"avatar_url":"https://avatars.githubusercontent.com/u/3372529?v=3","gravatar_id":"","url":"https://api.github.com/users/prashathsenthil","html_url":"https://github.com/prashathsenthil","followers_url":"https://api.github.com/users/prashathsenthil/followers","following_url":"https://api.github.com/users/prashathsenthil/following{/other_user}","gists_url":"https://api.github.com/users/prashathsenthil/gists{/gist_id}","starred_url":"https://api.github.com/users/prashathsenthil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prashathsenthil/subscriptions","organizations_url":"https://api.github.com/users/prashathsenthil/orgs","repos_url":"https://api.github.com/users/prashathsenthil/repos","events_url":"https://api.github.com/users/prashathsenthil/events{/privacy}","received_events_url":"https://api.github.com/users/prashathsenthil/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-08T19:16:03Z","updated_at":"2015-10-26T09:49:06Z","closed_at":"2015-10-19T12:50:28Z","body":"Hi,\r\n\r\nWe have a Java based web application where we use HDIV as our security framework. Fundamentally our app does not have any form tags, rather we have many AJAX calls which brings JSON/HTML response with which the cards in the pages are constructed. \r\n\r\nWe are making use of POST requests while dealing with sensitive data. Those data's are sent in POST request body. In order to be security compliant we do not include POST requests URL in the <hdiv:startPages> and if we do that we are getting HDIV related exceptions in our error log saying that \"HDIV_PARAMETER_NOT_EXISTS;\" we googled around and found that it is expecting the state ID and from these URL's (https://github.com/hdiv/hdiv/wiki/Appendix-C:-Ajax and https://github.com/hdiv/spring-mvc-showcase/blob/master/src/main/webapp/WEB-INF/views/partialform.jsp)we figured out how the HDIV state ID can be added for AJAX end points.\r\n\r\nBut the catch here is if the state ID is generated and appended as a query parameter to the AJAX end URL then HDIV is not throwing any exceptions since it identifies the state ID parameter from the end URL. On the other hand if we try to add the state ID in the request body then it throws the exception stating that the \"HDIV_PARAMETER_NOT_EXISTS;\". \r\n\r\nPrecisely, \r\n\r\n1. We are not suppose to include POST request AJAX end point in <hdiv:startPages>\r\n2. In order to do that we should append the state ID as part of the URL\r\n3. That state ID should be in POST request body and not as a query parameter in the URL.\r\n\r\nHDIV exception is thrown when state ID is in the request body and works only if it is available as a query parameter in the end point. For POST requests generally it is not recommended to add a parameter as a query string value.\r\n\r\nIt would be great if some one could guide us in this regard. \r\n\r\nThanks!!!\r\nSai "},"comment":{"url":"https://api.github.com/repos/hdiv/hdiv/issues/comments/151083589","html_url":"https://github.com/hdiv/hdiv/issues/83#issuecomment-151083589","issue_url":"https://api.github.com/repos/hdiv/hdiv/issues/83","id":151083589,"user":{"login":"prashathsenthil","id":3372529,"avatar_url":"https://avatars.githubusercontent.com/u/3372529?v=3","gravatar_id":"","url":"https://api.github.com/users/prashathsenthil","html_url":"https://github.com/prashathsenthil","followers_url":"https://api.github.com/users/prashathsenthil/followers","following_url":"https://api.github.com/users/prashathsenthil/following{/other_user}","gists_url":"https://api.github.com/users/prashathsenthil/gists{/gist_id}","starred_url":"https://api.github.com/users/prashathsenthil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prashathsenthil/subscriptions","organizations_url":"https://api.github.com/users/prashathsenthil/orgs","repos_url":"https://api.github.com/users/prashathsenthil/repos","events_url":"https://api.github.com/users/prashathsenthil/events{/privacy}","received_events_url":"https://api.github.com/users/prashathsenthil/received_events","type":"User","site_admin":false},"created_at":"2015-10-26T09:49:06Z","updated_at":"2015-10-26T09:49:06Z","body":"Hello,\r\n\r\nOur app is RESTful and there is no way to inject a form just for HDIV. I got a work around for this by adding the below code into the spring container.\r\n\r\n<c:url var=\"someURL\" value=\"/abc/show\">\r\n    <c:param name=\"_MODIFY_HDIV_STATE_\" value=\"${hdivFormStateId}\" />\r\n</c:url>\r\n<div data-url=\"${someURL}\" id=\"someURL\"></div>\r\n\r\nThe above div is referenced by this ID and the data-URL value is used while making POST requests."}}