What's the best way to skip CSRF for plugin controllers?

Question

I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), where the plugin will first check for valid Craft user account details or a plugin-generated key.

Since I'm still enforcing authentication, what's the best way to disable CSRF checks just for these posts when CSRF is globally enabled?

Thoughts I've had:

1. Attempt to put the CSRF key and token in the $_POST data as early as possible. (Probably not even possible.)
2. Have the client (desktop) script grab the CSRF key+token just before posting. (Inconvenient, potentially failure-prone.)
3. Somehow prevent CSRF protection from being enabled for requests passed to this controller.

Answer 1

Craft is piggybacking off of Yii's CSRF support for 90% of the work here and they've implemented it at the Request level (specifically onBeginRequest).

That happens way before Craft gets a chance to determine what type of request this is, much less figure out where to route it.

I think your best bet is going to be to put some logic in Craft's general.php config file that specifically check's for PHP's $_GET and $_POST globals for a p=some/path/to/my/plugin/controller and disables the enableCsrfProtection config setting for that request.

return array(
    'enableCsrfProtection' => (!isset($_SERVER['REQUEST_URI']) || $_SERVER['REQUEST_URI'] != '/actions/plugin/controller/action'),
);

Answer 2

In Craft 3 this is a cinch:

class PluginController extends Controller
{
    // Disable CSRF validation for the entire controller 
    public $enableCsrfValidation = false;

    ...

See the Yii2 docs for more control over inividual actions: https://github.com/yiisoft/yii2/blob/master/docs/guide/security-best-practices.md#avoiding-csrf

Answer 3

As Brad's answer suggests, you can conditionally enable or disable CSRF production via the General Config, based on any criteria you want.

Some use cases might be:

• match a SERVER['REQUEST_URI'] string or substring, to open up a particular set of controllers or actions

• check the $_SERVER['REMOTE_ADDR'], to allow token-less requests from a particular IP or IP range

• validate 'safe' requests based on a key or encrypted timestamp from some $_POST[] or $_GET[] variable

For cleanliness, I typically try to tuck the checking/validation logic away into its own "handler" class. Then, in the general.php, I set the enableCsrfProduction item based on the result of the check...

(In MyRequestHelper.php, something like...)

<?php
namespace Craft;

class MyRequestHelper
{

    public static function isApiRequest()
    {
        $path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
        return strpos($path, 'actions/my-api') == 1;
    }

}

(In craft/config/general.php, something like...)

require_once (..path/to/MyRequestHelper.php');
$isApiRequest = \Craft\MyRequestHelper::isApiRequest();

return [

    // ...other configs...

    'enableCsrfProtection' => !$isApiRequest,

];

Answer 4

UPDATE: This is not necessary to do when using Commerce 2.

---

I modified Michael's answer to add support for query strings + make it nicer to check for multiple routes:

if ( !function_exists('isApiRequest') ) {
    function isApiRequest ()
    {
        $path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
        $query = parse_url($_SERVER['REQUEST_URI'], PHP_URL_QUERY);

        $actions = [
            'actions/charge/webhook/callback',
            'actions/commerce/payments/completePayment',
            'actions/some/other/action',
            'actions/commerce/webhooks/process-webhook'

    ];

    foreach ($actions as $action) {
            if ( strpos($path, $action) || strpos($query, $action) ) {
                return true;
            }
        }

    return false;
    }
}

return [

    // ...other configs...

    'enableCsrfProtection' => !isApiRequest(),

];

Answer 5

Try to disable the CSRF protection by event

use Yii;
use yii\base\ActionEvent;
use yii\base\Event;
use yii\web\Controller;

Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
    if ($actionEvent->action->id == 'update-cart') {
        Yii::$app->controller->enableCsrfValidation = false;
    }
});