23
votes
What's the best way to skip CSRF for plugin controllers?
In Craft 3 this is a cinch:
class PluginController extends Controller
{
// Disable CSRF validation for the entire controller
public $enableCsrfValidation = false;
...
See the Yii2 docs ...
- 7,796
11
votes
What's the best way to skip CSRF for plugin controllers?
As Brad's answer suggests, you can conditionally enable or disable CSRF production via the General Config, based on any criteria you want.
Some use cases might be:
match a SERVER['REQUEST_URI'] ...
- 3,430
10
votes
What's the best way to skip CSRF for plugin controllers?
UPDATE: This is not necessary to do when using Commerce 2.
I modified Michael's answer to add support for query strings + make it nicer to check for multiple routes:
if ( !function_exists('...
- 2,997
10
votes
How can I use CSRF protection with AJAX routes?
This is the syntax for Craft 3:
<script type="text/javascript">
window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}";
window.csrfTokenValue = "{{ craft.app.request....
- 1,972
4
votes
What is the best way to append CSRF token without using a form?
This is the syntax for Craft 3:
<script type="text/javascript">
window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}";
window.csrfTokenValue = "{{ craft.app.request....
- 1,972
3
votes
Accepted
Headless CraftCMS as mobile app backend, requiring login
You could make the CSRF token available via an element API endpoint, then submit the form with that;
'api/csrf-token' => [
'elementType' => GlobalSet::class,
'paginate' => false,
...
- 2,502
3
votes
Axios post function got 400 bad request
Just found the solution:
npm install qs
and
import qs from 'qs'
...
const actions = {
auth({ commit }, { email, password }) {
axios.post('url', qs.stringify({
your token ...
- 397
3
votes
Accepted
Ajax post request front-end csrf token
You can take a look at the guide Enabling CSRF Protection
<script type="text/javascript">
window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName|e('js') }}";
window....
- 19.8k
3
votes
Accepted
Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms
Enable CSRF protection in your config again and add {{ getCsrfInput() }} right after the <form> opening tag on all forms on your site, regardless if they are amforms or mailchimp subscribe. I ...
- 1,972
3
votes
Webhook Error with Charge plugin
If CSRF protection is enabled (and it is by default for the latest versions of Craft), Stripe was getting a server error when using the Charge webhook url. The solution is to disable CSRF for the ...
- 1,463
3
votes
What's the best way to skip CSRF for plugin controllers?
Try to disable the CSRF protection by event
use Yii;
use yii\base\ActionEvent;
use yii\base\Event;
use yii\web\Controller;
Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (...
- 171
3
votes
How can I Prevent CSRF Tokens from being Cached?
Further to Ben’s answer, it may be inconvenient to set and replace every time the partial with the CSRF token is required, in which case the replacing can instead be done in one go for each page’s ...
- 223
2
votes
How can I Prevent CSRF Tokens from being Cached?
I was just looking for a way to do something similar without Javascript. Someone has released a cache escaping extension giving you the ability to wrap content you want esacped with a {% nocache %} ...
- 373
2
votes
Login - Bad Request: The CSRF token could not be verified
Once the same problem happened for me because of server caching and it may happen because of client-side cookie/cache. Sometimes, server caching will cache the entire form including CSRF token. So if ...
- 121
2
votes
Login - Bad Request: The CSRF token could not be verified
I have exactly the same issue, clearing cookies worked for me
- 21
2
votes
Accepted
Delete CSRF cookie on submit form success
I guesss this could be accomplished using the cookies plugin or a simple jquery cookies library like js-cookie.
This is how you would go about it with the cookies plugin: set the cookies name without ...
- 858
2
votes
AJAX CSRF Producing Inconsistent Results
Trying to understand the issue in general. These are my thoughts, not sure if they will help you.
I assume that by caching, you mean some sort of full page cache and the comments below are based on ...
- 121
2
votes
How to add CSRF cookie directive?
It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method
foreach ($this->getCookies() ...
- 19.8k
2
votes
CSRF token is null or empty in craft 2
For Craft 2, these are the values you're looking for...
window.csrfTokenName = "{{ craft.config.get('csrfTokenName') }}";
window.csrfTokenValue = "{{ craft.request.getCsrfToken }}";
They changed ...
- 24.1k
2
votes
Accepted
Sprig/Snaptcha CSRF issue/question
From your code sample it looks like you may be using Blitz to cache the page, in which case this is likely neither a Sprig issue nor a Snaptcha issue. A CSRF token is a dynamic token which should not ...
- 7,796
2
votes
JS login form on different domain and handling the CSRF token
I don't have a good answer for this, but my response is too long to to put into a comment so here goes. I've been experiencing the same thing — I can successfully retrieve the CSRF token, but when I ...
- 457
2
votes
Accepted
CSRF in plugin dashboard widget 400 error
as jQuery docs says you have to pass data object or string via data.
so you should change
var data = [];
to
var data = {};
in your code
- 534
2
votes
Accepted
Searching for a way to add products to cart and sending the csrf token with ajax
So normally in your main layout twig template, you'd have something like this to set some JS variables to hold the current CSRF token:
{# Super preliminary JS Stuff #}
<script type="...
- 7,647
2
votes
Accepted
CSRF token using Craft as an API
There are a few answers about controlling CSRF protection on a per-endpoint basis, or for requests where a token needs to be created on-the-fly, but I think your question is unique.
It sounds like ...
- 3,620
2
votes
CSRF token using Craft as an API
I managed to solve it using the answer August posted and created a tutorial that I hope helps others create APIs with Craft.
https://delasign.com/blog/craft-cms-api/
- 31
2
votes
Accepted
Ajax call returns 400 error after enable Blitz cache
I think the token needs to be refreshed with each request. When Blitz caches the page, you will have always the same token as the meta tags will include the token that was assigned at the time.
If you ...
- 703
1
vote
CRAFT_CSRF_TOKEN is failing to write
Ok - think I figured this out. Our dev site is hosted on a sub-domain of our production site, which is served over HTTPS. Seems like the CRAFT_CSRF_TOKEN
cookie set by our production site is the ...
- 81
1
vote
FreeForm and Vue - Hidden Forms in Modal - Manually refresh the Craft CRSF token and Freeform JS Honeypot field
Not sure if it's a good call or not but you could have an endpoint that just has the {{ craft.app.request.csrfToken }} outputting on it. Poll(GET) that using ajax (axios or whatever you're using in ...
- 624
1
vote
SSL now CP unknown errors
After much head scratching it wasn't an SSL issue. Litespeed had recently been installed on the shared server but was misconfigured.
It appears the allowed header size default value was modified ...
- 169
1
vote
Contact Form plugin - using Ajax, CSRF 400 bad request
Looks like you need to pass the csrf token through within your data as noted here https://craftcms.com/support/csrf-protection#updating-your-javascript
- 110
Only top scored, non community-wiki answers of a minimum length are eligible