Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

The tag has no usage guidance.

1
vote
1answer
21 views

AJAX CSRF Producing Inconsistent Results

I am using CSRF tokens in a form on CraftCMS. Submissions are successful with a standard configuration. Introducing "fresh" CSRF tokens via AJAX on page load is causing some trouble. This is ...
1
vote
1answer
25 views

Craft CSRF protection and Facebook Tab

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is ...
1
vote
1answer
92 views

Another AJAX CSRF question

I have quite a simple registration form, something like this: <script type="text/javascript"> window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}"; window....
1
vote
1answer
73 views

CSRF Protection in AJAX post

I'm having some trouble passing CSRF-tokens in my js-File in Craft 3. I'm setting the values in my template like so: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app....
0
votes
0answers
187 views

CSRF Cookie isn't getting set in certain browsers

Seems like Chrome (67) will not set the CSRF cookie, which breaks all of my ajax requests. The CSRF tokens are not cached This is still an issue when caching is turned off This works when CSRF is ...
1
vote
1answer
645 views

Axios post function got 400 bad request

I created a Vue component. And in this component, I use axios to send post request when it's mounted, CSRF token also included, but still got 400 status. Anyone know why?
0
votes
0answers
107 views

CSRF with a Load Balanceer

I have a website where I get the following error bad request: CSRF token could not be verified I have the config setting set to true as well as adding the token to all of my forms via the docs. My ...
1
vote
3answers
746 views

Contact Form plugin - using Ajax, CSRF 400 bad request

I am using the Contact Form plugin with AJAX. I have used the JS AJAX script supplied in the plugin but i get a 'Bad request: CSRF token could not be verified' error. I have seen many other posts on ...
1
vote
0answers
340 views

How to access logged in CSRF token?

I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft ...
1
vote
1answer
140 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
1
vote
1answer
153 views

Webhook Error with Charge plugin

Stripe is throwing a server error when trying to access a webhook to the Charge plugin. Some investigation revealed the error is triggered by an 'invalid or missing CSRF token.
1
vote
1answer
2k views

Login - Bad Request: The CSRF token could not be verified

I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my /etc/hosts file on my Mac to point to the IP address for testing. Whilst checking ...
1
vote
0answers
279 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
2
votes
1answer
269 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
2
votes
1answer
481 views

Bad Request with weird params

I just installed Craft fresh, there's almost nothing in my DB as I'm just beginning to develop a plugin. All I want is to save a new entry from the frontend of my website. I've done this before in ...
1
vote
0answers
580 views

Can’t log in to the Craft control panel

After I input my credentials, it just stayed on the login page, and did not go to the dashboard. The password is good, we didn't get invalid username and password error. I opened the trace mode and ...
0
votes
0answers
2k views

CSRF token could not be verified - ajax

I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with. I've read the ...
3
votes
1answer
265 views

Using CRSF, AJAX form posts, with a CDN

We have a setup where we have a Contact Us page that submits a form using the plugin from P&T. We will have quite some load on the site, so want to keep all of the GET responses in a CDN cache, ...
1
vote
1answer
509 views

CSRF admin Login

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"'...
6
votes
5answers
2k views

How can I Prevent CSRF Tokens from being Cached?

We have a Craft site in which we include a partial that includes in several different places. CSRF is enabled, and we're appending {{ getCsrfInput() }} to the form. Because of the way we've set up ...
1
vote
2answers
832 views

Does CSRF protection for controller actions require POST?

I've got a controller action which will work as the callback URL for OAUTH authentication with an external, third-party API. After authenticating, the external API will issue a GET request to my ...
3
votes
2answers
2k views

What is the best way to append CSRF token without using a form?

I have built a plugin that simply makes requests to a 3rd party API. I am calling my plugin action via ajax. I don't have a form on this page currently. Here is what I am using, but I am getting the ...
0
votes
1answer
480 views

In a plugin, what's the way in PHP to output a CSRF token?

My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo? EDIT to document the final answer $token = craft()->...
1
vote
1answer
851 views

Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

I have the following scenario: A page is loaded via HTTP The user fills out a form and submits its contents via HTTPS The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is ...
6
votes
2answers
3k views

How can I use CSRF protection with AJAX routes?

I have CSRF enabled on my install. I have a bunch of frontend forms so CSRF is pretty important for me. However, when I use AJAX to post to a controller action I get the following error. <div id="...
4
votes
1answer
751 views

How can I ensure using actionUrl in my template does not show script name in the generated URL?

I have an controller action in my custom plugin that processes Paypal IPN requests. How it works is that you provide a URL for Paypal to send it's notification requests to and then process them and ...
7
votes
4answers
3k views

What's the best way to skip CSRF for plugin controllers?

I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), ...
5
votes
1answer
426 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
2
votes
1answer
430 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...