7

On plain Sitecore 8.2 instance with WFFM on it I see next messages in the log:

11404 20:29:34 INFO [Experience Analytics]: Request: http://host.name/sitecore/api/ao/aggregates/all/7A9A483F195D4F96AD88473CD6854C4F/all?&dateGrouping=by-week&&keyTop=5&keyOrderBy=visits-Asc&dateFrom=06-08-2016&dateTo=06-11-2016&keyGrouping=by-key returned messages.

If I open that URL, I see the following JSON:

{
    message: "An error has occurred.",
    exceptionMessage: "The required anti-forgery form field "__RequestVerificationToken" is not present.",
    exceptionType: "System.Web.Mvc.HttpAntiForgeryException",
    stackTrace: " at 
        System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken) at 
        System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext) at Sitecore.Web.Http.Filters.ValidateHttpAntiForgeryTokenAttribute.OnAuthorization(HttpActionContext actionContext)"
}

What does that affect? How we can fix that?

9

Explaining the log message

11404 20:29:34 INFO [Experience Analytics]: Request: http://host.name/sitecore/api/ao/aggregates/all/7A9A483F195D4F96AD88473CD6854C4F/all?&dateGrouping=by-week&&keyTop=5&keyOrderBy=visits-Asc&dateFrom=06-08-2016&dateTo=06-11-2016&keyGrouping=by-key returned messages.

This is not an error, this is just an INFO log message saying that the API at the given URL has been accessed.

This is not something to be concerned about. You're only seeing this message because the Sitecore log level is set up low enough. You can change your log level to WARN or ERROR if you don't want the log to be overly verbose.

Explaining the anti-forgery field error

Experience Analytics seems to be using ASP.NET MVC for its RESTful API. It uses anti-forgery tokens to prevent CSRF attacks.

Only the Experience Analytics application should access these API endpoints. You are not supposed to access them directly from the browser—it's not going to work since your request does not include an anti-forgery token. So receiving that error is in fact intended behavior.

Conclusion

You shouldn't worry because of the messages you're seeing.

| improve this answer | |
  • 1
    Thanks, just wanted to be sure we are 100% good with the setup. – Volodymyr Hil Nov 7 '16 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.