Questions tagged [csrf]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
11 views

How to append current version to post URL - versioning a post

I'm middle of a PWA app and one of the problems facing is versioning, once the post cached using Service Worker and if any change amended(ex: if it is an event post, the event end date may be extended....
1
vote
1answer
32 views

CSRF in plugin dashboard widget 400 error

Yes, it's another csrf question, the standard, 400 Error - Bad Request: Unable to verify your data submission. If in config/general.php I set 'enableCsrfProtection' => false, then everything works ...
0
votes
0answers
41 views

What's left to troubleshoot this quirky “Unable to verify your data submission” behavior?

I have a frontend login form that sends a request to Craft's own actions/users/login action. I've used this same process in another project and it works there, but not here, and I can't figure out ...
1
vote
1answer
123 views

SSL now CP unknown errors

I have a Craft 3 site that's been running on a production server. Recently we switched over to https but this has caused issues in the CP (multiple 'An unknown error occurred' red flags, can't view ...
3
votes
1answer
372 views

Headless CraftCMS as mobile app backend, requiring login

Currently building a mobile app with Phonegap, I'm able to use the Element API for many features, but when comes the time to use Craft as a loggedin user, I run out of ideas. I read a lot of things ...
1
vote
1answer
185 views

FreeForm and Vue - Hidden Forms in Modal - Manually refresh the Craft CRSF token and Freeform JS Honeypot field

Anyone using FreeForm and Vue together? I have a form that is hidden away in a modal (that is then shown using Vue) via a click of a button. Vue is only used to hide the form and show the form. the ...
1
vote
1answer
80 views

How to add CSRF cookie directive?

I need to add the SameSite directive to my site's CSRF cookie, as explained in these mozilla security guidelines. According to the Craft docs, "Craft handles the cookie creation automatically." Is ...
1
vote
1answer
208 views

CSRF token is null or empty in craft 2

I'm having an issue with Craft 2.6 and the CSRF token. I enabled Csrf Protection in my general.php file by adding this line $config['*'] array so it looks like: $config['*'] = [ ... '...
0
votes
1answer
287 views

Ajax post request front-end csrf token

I'm trying to make a simple post request with ajax to a controller in plugin. The problem I'm having is that I always get a 400 Bad request because I don't send a valid CSRF Token. But I can't figure ...
1
vote
1answer
231 views

AJAX CSRF Producing Inconsistent Results

I am using CSRF tokens in a form on CraftCMS. Submissions are successful with a standard configuration. Introducing "fresh" CSRF tokens via AJAX on page load is causing some trouble. This is ...
1
vote
1answer
44 views

Craft CSRF protection and Facebook Tab

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is ...
1
vote
1answer
434 views

Another AJAX CSRF question

I have quite a simple registration form, something like this: <script type="text/javascript"> window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}"; window....
1
vote
1answer
710 views

CSRF Protection in AJAX post

I'm having some trouble passing CSRF-tokens in my js-File in Craft 3. I'm setting the values in my template like so: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app....
2
votes
1answer
3k views

Axios post function got 400 bad request

I created a Vue component. And in this component, I use axios to send post request when it's mounted, CSRF token also included, but still got 400 status. Anyone know why?
1
vote
3answers
1k views

Contact Form plugin - using Ajax, CSRF 400 bad request

I am using the Contact Form plugin with AJAX. I have used the JS AJAX script supplied in the plugin but i get a 'Bad request: CSRF token could not be verified' error. I have seen many other posts on ...
1
vote
0answers
589 views

How to access logged in CSRF token?

I’m currently using react as a font end SPA with craft cms as the backend. I’m trying to create user accounts where a user use can sign up and favourite content on the site, using the Like for craft ...
1
vote
1answer
270 views

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

I'm using the MailChimp Subscribe for Craft plugin to embed several subscription forms on a website I'm building. The following code appears via my master _layout.html file: <form action="" ...
1
vote
1answer
206 views

Webhook Error with Charge plugin

Stripe is throwing a server error when trying to access a webhook to the Charge plugin. Some investigation revealed the error is triggered by an 'invalid or missing CSRF token.
1
vote
1answer
3k views

Login - Bad Request: The CSRF token could not be verified

I have just deployed an existing site to a new server. As the DNS is not pointing there yet, I have simply edited my /etc/hosts file on my Mac to point to the IP address for testing. Whilst checking ...
1
vote
0answers
437 views

CSRF token creation and Content-Security-Policy header

I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one. The relevant part of my .htaccess ...
2
votes
1answer
429 views

Delete CSRF cookie on submit form success

I need to delete the CRAFT_CSRF_TOKEN cookie when a form submission reaches certain/success page. I'm using CSRF stripped cookie's value to store entry title like this: {% set token = craft.request....
2
votes
1answer
679 views

Bad Request with weird params

I just installed Craft fresh, there's almost nothing in my DB as I'm just beginning to develop a plugin. All I want is to save a new entry from the frontend of my website. I've done this before in ...
1
vote
0answers
757 views

Can’t log in to the Craft control panel

After I input my credentials, it just stayed on the login page, and did not go to the dashboard. The password is good, we didn't get invalid username and password error. I opened the trace mode and ...
0
votes
0answers
2k views

CSRF token could not be verified - ajax

I've got a Craft plugin that returns some results based on filter options on the front end. The filter sends an ajax submissions and returns the markup to populate the front end with. I've read the ...
3
votes
1answer
343 views

Using CRSF, AJAX form posts, with a CDN

We have a setup where we have a Contact Us page that submits a form using the plugin from P&T. We will have quite some load on the site, so want to keep all of the GET responses in a CDN cache, ...
1
vote
1answer
604 views

CSRF admin Login

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"'...
5
votes
5answers
3k views

How can I Prevent CSRF Tokens from being Cached?

We have a Craft site in which we include a partial that includes in several different places. CSRF is enabled, and we're appending {{ getCsrfInput() }} to the form. Because of the way we've set up ...
1
vote
2answers
1k views

Does CSRF protection for controller actions require POST?

I've got a controller action which will work as the callback URL for OAUTH authentication with an external, third-party API. After authenticating, the external API will issue a GET request to my ...
3
votes
2answers
3k views

What is the best way to append CSRF token without using a form?

I have built a plugin that simply makes requests to a 3rd party API. I am calling my plugin action via ajax. I don't have a form on this page currently. Here is what I am using, but I am getting the ...
0
votes
1answer
653 views

In a plugin, what's the way in PHP to output a CSRF token?

My plugin has a tab in the CP. On that tab is a form. What's the way for PHP to generate a CSRF token that can be output to the form with echo? EDIT to document the final answer $token = craft()->...
1
vote
1answer
910 views

Load a page via HTTP and make an AJAX request via HTTPS afterwards using CSRF-Token

I have the following scenario: A page is loaded via HTTP The user fills out a form and submits its contents via HTTPS The craft CSRF prevention is enabled, so the previousy generated CSRF-Token is ...
8
votes
2answers
5k views

How can I use CSRF protection with AJAX routes?

I have CSRF enabled on my install. I have a bunch of frontend forms so CSRF is pretty important for me. However, when I use AJAX to post to a controller action I get the following error. <div id="...
4
votes
1answer
802 views

How can I ensure using actionUrl in my template does not show script name in the generated URL?

I have an controller action in my custom plugin that processes Paypal IPN requests. How it works is that you provide a URL for Paypal to send it's notification requests to and then process them and ...
9
votes
4answers
5k views

What's the best way to skip CSRF for plugin controllers?

I'm working on a plugin that'll create a private API for content authors to post entries to Craft from desktop-based scripts. These scripts post data to plugin controller actions (anonymous-allowed), ...
5
votes
1answer
486 views

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We've enabled CSRF Protection on a site. When we do, it sometimes works, but most of the time it gets tripped and triggers false positives and doesn't allow our forms to be submitted. Things we've ...
2
votes
1answer
575 views

How do I test if Craft CSRF Protection is properly enabled?

Craft supports enabling CSRF protection on our front-end forms. They even have a nice, easy-to-follow, help page called "How do I enable CSRF protection?" Let's say we pull that all off without a ...