# CsrfValidationException on Custom Plugin REST Endpoint Despite GET Request **URL:** \ **Category:** IIQ Discussion and Questions\ **Tags:** plugins, identityiq\ **Created:** [October 27, 2026, 9:11am UTC](https://developer.sailpoint.com/discuss/t/csrfvalidationexception-on-custom-plugin-rest-endpoint-despite-get-request/227428 "2026-10-27T09:11:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![winnieay](https://avatars.discourse-cdn.com/v4/letter/w/e274bd/32.png) [@winnieay](https://developer.sailpoint.com/discuss/u/winnieay)\ **Post date:** [October 27, 2026, 9:11am UTC](https://developer.sailpoint.com/discuss/t/csrfvalidationexception-on-custom-plugin-rest-endpoint-despite-get-request/227428/1 "2026-10-27T09:11:53Z")
Hi everyone, I am building a custom IdentityIQ plugin that uses a JavaScript snippet on the home page to query a custom plugin REST endpoint (`ChatResource`). Even after changing my endpoint method from `POST` to `GET` to avoid state-changing CSRF filters, I am still encountering the following security exception in the system logs when the frontend script queries the endpoint: ### **The Error:** ```xml CSRF validation failed for /identityiq/plugin/rest/iiqbot/ask ``` ### ChatResource.java: ```xml @GET @Path("ask") public Response ask(@QueryParam("message") String message) { Map result = new HashMap<>(); try { SailPointContext context = getContext(); Identity user = getLoggedInUser(); String msg = (message != null) ? message.toLowerCase().trim() : ""; String reply = buildReply(context, user, msg); result.put("reply", reply); return Response.ok(result).build(); } catch (Exception e) { result.put("reply", "An error occurred: " + e.getMessage()); return Response.status(Response.Status.INTERNAL_SERVER_ERROR).entity(result).build(); } } ``` ### snippet.js: ```xml jQuery.ajax({ url: restUrl, type: 'GET', dataType: 'text', success: function(res) { var replyText = (res && res.reply) ? res.reply : "Received empty response from server."; msgContainer.append('
' + replyText + '
'); msgContainer.scrollTop(msgContainer[0].scrollHeight); }, error: function(xhr, textStatus, errorThrown) { var debugMsg = 'Error: ' + textStatus + '
Response: ' + xhr.responseText; msgContainer.append('
' + debugMsg + '
'); msgContainer.scrollTop(msgContainer[0].scrollHeight); } }); ``` ### **My Setup:** 1. **Java Resource Class:** Extends `BasePluginResource` with `@Path("iiqbot")` and `@AllowAll`. 2. **Method Annotation:** Annotated with `@GET` and `@Path("ask")`. 3. **Frontend Call:** Using `PluginHelper.getPluginRestUrl('iiqbot/ask?message=...')` via `jQuery.ajax`. Why is `RestCsrfValidationFilter` intercepting and throwing a `CsrfValidationException` on a `@GET` request under `/plugin/rest/*`, and how can I correctly authorize or exempt a custom plugin REST endpoint from this validation? If i access: [http://[ip]:8080/identityiq/plugin/rest/iiqbot/ask](http://localhost:8080/identityiq/plugin/rest/iiqchatbot/ask), then get “CSRF validation failed” error. In my plugin snippet ui, i get the output mentioned below: ![image](https://global.discourse-cdn.com/sailpoint/original/3X/4/6/4641071f716302ba7f53c05071b7723379b0fa7f.png) Any help or best practices would be greatly appreciated! ---
**Author:** ![chaitanyav](https://avatars.discourse-cdn.com/v4/letter/c/f475e1/32.png) [@chaitanyav](https://developer.sailpoint.com/discuss/u/chaitanyav)\ **Post date:** [October 27, 2026, 6:29pm UTC](https://developer.sailpoint.com/discuss/t/csrfvalidationexception-on-custom-plugin-rest-endpoint-despite-get-request/227428/2 "2026-10-27T18:29:18Z")
the problem is the request is missing authentication in the ajax call, so u need to pass the CSRF token from there to make sure api call works. you can use the PluginHelper.getCsrfToken(); which comes out of box and it should helo with the error. ---
**Author:** ![naveenkumar3](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/naveenkumar3/32/39339_2.png) [@naveenkumar3](https://developer.sailpoint.com/discuss/u/naveenkumar3)\ **Post date:** [October 27, 2026, 11:23pm UTC](https://developer.sailpoint.com/discuss/t/csrfvalidationexception-on-custom-plugin-rest-endpoint-despite-get-request/227428/3 "2026-10-27T23:23:14Z")
Switching from POST to GET won’t get fix the issue. The CSRF filter on `/plugin/rest/*` checks for the session’s CSRF token in a request header, regardless of HTTP method, and `@AllowAll` only controls authorization, not CSRF. Opening the URL directly in the browser will always fail for the same reason, since an address-bar request can’t send that header. can you send the token with your ajax call: ```auto jQuery.ajax({ url: restUrl, type: 'GET', dataType: 'json', headers: {'X-XSRF-TOKEN': PluginHelper.getCsrfToken()}, ... }); ``` I wouldn’t disable CSRF globally. cab you please check the plugin docs if `PluginHelper.getCsrfToken()` is available. **can you fix below things also** 1. With `dataType: 'text'`, `res` is a plain string, so `res.reply` is always undefined and you’ll get the “empty response” message. Use `dataType: 'json'` (or `JSON.parse(res)`). 2. Wrap the message in `encodeURIComponent()` when you build the query string. 3. You’re appending `replyText` and `xhr.responseText` as raw HTML. Use `.text()` on a created element instead to avoid XSS. 4. Add `@Produces(MediaType.APPLICATION_JSON)` to your resource method or class. 5. Don’t return `e.getMessage()` to the browser. Log it server-side and return a generic message. 6. Consider `@RequiredRight` instead of `@AllowAll` if the replies expose identity or access data. try it and let me know if it fix your issue