1

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:

    <script type="text/javascript">
    var cookieTest = 'CraftCookieTest='+Math.floor(Math.random() * 1000000);
    document.cookie = cookieTest;
    var cookiesEnabled = document.cookie.search(cookieTest) != -1;
    if (cookiesEnabled)
    {
        document.cookie = cookieTest + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';

        document.write(
            '{%- set hasLogo = (CraftEdition >= CraftClient and craft.rebrand.isLogoUploaded ? true : false) -%}'+
            '<form id="login-form" method="post" accept-charset="UTF-8" name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}" {% if hasLogo -%}
                    {%- set logo = craft.rebrand.logo -%}
                    {%- set padding = logo.height + 30 -%}
                    class="has-logo" style="background-image: url(\'{{ logo.url }}\'); background-size: {{ logo.width }}px {{ logo.height }}px; padding-top: {{ padding }}px; margin-top: -{{ round((353+padding)/2) }}px"
                {%- endif %}>' +
                '{% if not hasLogo -%}<h1>{{ siteName }}</h1>{%- endif %}'+
                '{% set placeHolderText = (craft.config.useEmailAsUsername ? "Email"|t : "Username or Email"|t) %}' +
                '{{ forms.textField({ id: "loginName", name: "username", placeholder: placeHolderText, value: username })|e("js") }}' +

                '<div id="login-fields" class="nested-fields">' +
                    '{{ forms.passwordField({ id: "password", name: "password", placeholder: "Password"|t })|e("js") }}' +
                    '<a id="forgot-password">{{ "Forget your password?"|t }}</a>' +
                    {% if craft.config.rememberedUserSessionDuration %}
                        '{{ forms.checkboxField({ id: "rememberMe", label: "Keep me logged in"|t })|e("js") }}' +
                    {% endif %}
                '</div>' +

                '<div class="buttons">' +
                    '{# <div id="ssl-icon" class="disabled"><div class="{{ craft.request.isSecure ? "secure" : "insecure" }} icon"></div></div>#}' +
                    '<input id="submit" class="btn submit disabled" type="submit" value="{{ "Login"|t }}">' +
                    '<div id="spinner" class="spinner hidden"></div>' +
                '</div>' +
                '<a id="poweredby" href="http://craftcms.com/" title="{{ "Powered by Craft CMS"|t }}"><img src="{{ resourceUrl("images/craftcms.svg") }}" /></a>'+
            '</form>'
        );

        {% if not craft.request.isMobileBrowser(true) %}
            document.getElementById("{{ (username ? 'password' : 'loginName') }}").focus();
        {% endif %}
    }
    else
    {
        document.write(
            '<div class="no-access">' +
                '<div class="pane">' +
                    '<div class="pane-body">' +
                        '<div class="notice">' +
                            '<div class="icon"></div>' +
                            '<p>{{ "Cookies must be enabled to access the Craft CMS control panel."|t }}<br>' +
                                '<a class="go nowrap" href="">{{ "See how"|t }}</a>' +
                            '</p>' +
                        '</div>' +
                    '</div>' +
                '</div>' +
            '</div>'
        );
    }
</script>

I believe this is all correct, but not sure how this could be tested?

Thanks

2

the CSRF field its a hidden field not part of the form attributes.
You don't have to manually type it, craft twig comes with {{ getCsrfInput() }} that recreates a hidden field between the <form></form> tags.

<form method="post">
    {{ getCsrfInput() }}
    <!-- ... -->
</form>

Also, that seems to be a Javascript call if you are doing Ajax you need to add those variables to the script so the action knows about them.

<script>
window.csrfTokenName = "{{ craft.config.csrfTokenName|e('js') }}";
window.csrfTokenValue = "{{ craft.request.csrfToken|e('js') }}";
</script>

Usually works for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.