Hot answers tagged

23 votes

What's the best way to skip CSRF for plugin controllers?

In Craft 3 this is a cinch: class PluginController extends Controller { // Disable CSRF validation for the entire controller public $enableCsrfValidation = false; ... See the Yii2 docs ...
Ben Croker's user avatar
  • 7,286
11 votes

What's the best way to skip CSRF for plugin controllers?

As Brad's answer suggests, you can conditionally enable or disable CSRF production via the General Config, based on any criteria you want. Some use cases might be: match a SERVER['REQUEST_URI'] ...
Michael Rog's user avatar
  • 3,410
11 votes
Accepted

How can I Prevent CSRF Tokens from being Cached?

You can do something like this: // First, set all your cached content to a variable: {% set myContent %} {% cache %} {# YOUR CACHED CONTENT #} %%MY_CSRF%% {% endcache %} {% endset %} // ...
Ben Wilkins's user avatar
10 votes

What's the best way to skip CSRF for plugin controllers?

UPDATE: This is not necessary to do when using Commerce 2. I modified Michael's answer to add support for query strings + make it nicer to check for multiple routes: if ( !function_exists('...
Fred Carlsen's user avatar
  • 2,997
10 votes

How can I use CSRF protection with AJAX routes?

This is the syntax for Craft 3: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}"; window.csrfTokenValue = "{{ craft.app.request....
Ryan's user avatar
  • 1,952
9 votes

How can I Prevent CSRF Tokens from being Cached?

The trick is to inject the CSRF field using JavaScript. Omit the standard getCsrfInput Twig tag. Give your form(s) the class of csrf. Add this Twig code outside of the cached area: {% includejs %} ...
Lindsey D's user avatar
  • 24k
4 votes

What is the best way to append CSRF token without using a form?

This is the syntax for Craft 3: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}"; window.csrfTokenValue = "{{ craft.app.request....
Ryan's user avatar
  • 1,952
4 votes

Using CRSF, AJAX form posts, with a CDN

I don't think you can cache that, since the tag is run server-side and rendered with template output, and will be unique on every page load. If you have content that's unique on every page load, you'd ...
Ben Wilkins's user avatar
3 votes
Accepted

Headless CraftCMS as mobile app backend, requiring login

You could make the CSRF token available via an element API endpoint, then submit the form with that; 'api/csrf-token' => [ 'elementType' => GlobalSet::class, 'paginate' => false, ...
dmatthams's user avatar
  • 2,492
3 votes
Accepted

Ajax post request front-end csrf token

You can take a look at the guide Enabling CSRF Protection <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName|e('js') }}"; window....
Robin Schambach's user avatar
3 votes

Axios post function got 400 bad request

Just found the solution: npm install qs and import qs from 'qs' ... const actions = { auth({ commit }, { email, password }) { axios.post('url', qs.stringify({ your token ...
yu xia's user avatar
  • 397
3 votes
Accepted

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

Enable CSRF protection in your config again and add {{ getCsrfInput() }} right after the <form> opening tag on all forms on your site, regardless if they are amforms or mailchimp subscribe. I ...
Ryan's user avatar
  • 1,952
3 votes

Webhook Error with Charge plugin

If CSRF protection is enabled (and it is by default for the latest versions of Craft), Stripe was getting a server error when using the Charge webhook url. The solution is to disable CSRF for the ...
Roi Agneta's user avatar
  • 1,463
3 votes

How can I Prevent CSRF Tokens from being Cached?

Further to Ben’s answer, it may be inconvenient to set and replace every time the partial with the CSRF token is required, in which case the replacing can instead be done in one go for each page’s ...
David Oliver's user avatar
3 votes

What's the best way to skip CSRF for plugin controllers?

Try to disable the CSRF protection by event use Yii; use yii\base\ActionEvent; use yii\base\Event; use yii\web\Controller; Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (...
Mostafa Soufi's user avatar
2 votes

Does CSRF protection for controller actions require POST?

Chris is quite correct – CSRF does not work with GET requests (see this answer by Brad Bell for an explanation). I'm posting my workaround as an additional answer in case anyone else ever needs to ...
Mats Mikkel Rummelhoff's user avatar
2 votes
Accepted

Does CSRF protection for controller actions require POST?

According to https://craftcms.com/support/csrf-protection CSRF does require POST requests With CSRF protection enabled, all of your site’s visitors will get a “CRAFT_CSRF_TOKEN” cookie set on their ...
chris's user avatar
  • 906
2 votes

How can I Prevent CSRF Tokens from being Cached?

I was just looking for a way to do something similar without Javascript. Someone has released a cache escaping extension giving you the ability to wrap content you want esacped with a {% nocache %} ...
jthomas's user avatar
  • 373
2 votes

Login - Bad Request: The CSRF token could not be verified

Once the same problem happened for me because of server caching and it may happen because of client-side cookie/cache. Sometimes, server caching will cache the entire form including CSRF token. So if ...
shihab mm's user avatar
  • 121
2 votes

Login - Bad Request: The CSRF token could not be verified

I have exactly the same issue, clearing cookies worked for me
swalker's user avatar
  • 21
2 votes
Accepted

Delete CSRF cookie on submit form success

I guesss this could be accomplished using the cookies plugin or a simple jquery cookies library like js-cookie. This is how you would go about it with the cookies plugin: set the cookies name without ...
Jan_dh's user avatar
  • 858
2 votes
Accepted

CSRF admin Login

the CSRF field its a hidden field not part of the form attributes. You don't have to manually type it, craft twig comes with {{ getCsrfInput() }} that recreates a hidden field between the <form><...
Xpertbot's user avatar
  • 191
2 votes

AJAX CSRF Producing Inconsistent Results

Trying to understand the issue in general. These are my thoughts, not sure if they will help you. I assume that by caching, you mean some sort of full page cache and the comments below are based on ...
RoussKS's user avatar
  • 121
2 votes

How to add CSRF cookie directive?

It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method foreach ($this->getCookies() ...
Robin Schambach's user avatar
2 votes

CSRF token is null or empty in craft 2

For Craft 2, these are the values you're looking for... window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}"; window.csrfTokenValue = "{{ craft.request.getCsrfToken }}"; They changed ...
Lindsey D's user avatar
  • 24k
2 votes
Accepted

CSRF in plugin dashboard widget 400 error

as jQuery docs says you have to pass data object or string via data. so you should change var data = []; to var data = {}; in your code
user9975's user avatar
  • 534
2 votes

JS login form on different domain and handling the CSRF token

I don't have a good answer for this, but my response is too long to to put into a comment so here goes. I've been experiencing the same thing — I can successfully retrieve the CSRF token, but when I ...
Dalton Rooney's user avatar
2 votes
Accepted

Sprig/Snaptcha CSRF issue/question

From your code sample it looks like you may be using Blitz to cache the page, in which case this is likely neither a Sprig issue nor a Snaptcha issue. A CSRF token is a dynamic token which should not ...
Ben Croker's user avatar
  • 7,286
2 votes
Accepted

Searching for a way to add products to cart and sending the csrf token with ajax

So normally in your main layout twig template, you'd have something like this to set some JS variables to hold the current CSRF token: {# Super preliminary JS Stuff #} <script type="...
Jeremy Daalder's user avatar
2 votes
Accepted

CSRF token using Craft as an API

There are a few answers about controlling CSRF protection on a per-endpoint basis, or for requests where a token needs to be created on-the-fly, but I think your question is unique. It sounds like ...
August Miller's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible