Hot answers tagged

22 votes

What's the best way to skip CSRF for plugin controllers?

In Craft 3 this is a cinch: class PluginController extends Controller { // Disable CSRF validation for the entire controller public $enableCsrfValidation = false; ... See the Yii2 docs ...
user avatar
  • 6,226
21 votes
Accepted

How can I use CSRF protection with AJAX routes?

Disabling the CSRF protection is probably a bad idea... it's in there for a reason. But you can easily add your CSRF data to an AJAX call, and it works very well! The key is to make your CSRF token ...
user avatar
  • 23.6k
13 votes
Accepted

What's the best way to skip CSRF for plugin controllers?

Craft is piggybacking off of Yii's CSRF support for 90% of the work here and they've implemented it at the Request level (specifically onBeginRequest). That happens way before Craft gets a chance to ...
user avatar
  • 66.4k
11 votes

What's the best way to skip CSRF for plugin controllers?

As Brad's answer suggests, you can conditionally enable or disable CSRF production via the General Config, based on any criteria you want. Some use cases might be: match a SERVER['REQUEST_URI'] ...
user avatar
  • 3,400
10 votes

How can I use CSRF protection with AJAX routes?

This is the syntax for Craft 3: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}"; window.csrfTokenValue = "{{ craft.app.request....
user avatar
  • 1,907
10 votes

What's the best way to skip CSRF for plugin controllers?

UPDATE: This is not necessary to do when using Commerce 2. I modified Michael's answer to add support for query strings + make it nicer to check for multiple routes: if ( !function_exists('...
user avatar
  • 2,957
10 votes
Accepted

How can I Prevent CSRF Tokens from being Cached?

You can do something like this: // First, set all your cached content to a variable: {% set myContent %} {% cache %} {# YOUR CACHED CONTENT #} %%MY_CSRF%% {% endcache %} {% endset %} // ...
user avatar
9 votes

How can I Prevent CSRF Tokens from being Cached?

The trick is to inject the CSRF field using JavaScript. Omit the standard getCsrfInput Twig tag. Give your form(s) the class of csrf. Add this Twig code outside of the cached area: {% includejs %} ...
user avatar
  • 23.6k
8 votes

Forms are triggering CSRF Protection. Why would CSRF Protection trigger false positives?

We got this sorted before I finished my Stack Exchange question so I figured I'd share if anyone else runs into similar behavior. After some troubleshooting, we learned that the issue here was that ...
user avatar
  • 13.2k
5 votes
Accepted

How can I ensure using actionUrl in my template does not show script name in the generated URL?

actionUrl() and UrlHelper::getActionUrl() always force the script name to show up despite the omitScriptNameInUrls config setting for two reasons: Action URLs are generally not actually visible to ...
user avatar
5 votes
Accepted

What is the best way to append CSRF token without using a form?

You need to pass the token and name into javascript. Easiest is to just have a script tag somewhere. <script type="text/javascript"> window.csrfTokenName = "{{ craft.config.csrfTokenName }}"...
user avatar
  • 1,332
4 votes

What is the best way to append CSRF token without using a form?

This is the syntax for Craft 3: <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName }}"; window.csrfTokenValue = "{{ craft.app.request....
user avatar
  • 1,907
4 votes

Using CRSF, AJAX form posts, with a CDN

I don't think you can cache that, since the tag is run server-side and rendered with template output, and will be unique on every page load. If you have content that's unique on every page load, you'd ...
user avatar
3 votes

Axios post function got 400 bad request

Just found the solution: npm install qs and import qs from 'qs' ... const actions = { auth({ commit }, { email, password }) { axios.post('url', qs.stringify({ your token ...
user avatar
  • 387
3 votes
Accepted

Enabling CSRF Protection for Mailchimp Subscribe plugin and other forms

Enable CSRF protection in your config again and add {{ getCsrfInput() }} right after the <form> opening tag on all forms on your site, regardless if they are amforms or mailchimp subscribe. I ...
user avatar
  • 1,907
3 votes

Webhook Error with Charge plugin

If CSRF protection is enabled (and it is by default for the latest versions of Craft), Stripe was getting a server error when using the Charge webhook url. The solution is to disable CSRF for the ...
user avatar
  • 1,311
3 votes

How can I Prevent CSRF Tokens from being Cached?

Further to Ben’s answer, it may be inconvenient to set and replace every time the partial with the CSRF token is required, in which case the replacing can instead be done in one go for each page’s ...
user avatar
3 votes
Accepted

Ajax post request front-end csrf token

You can take a look at the guide Enabling CSRF Protection <script type="text/javascript"> window.csrfTokenName = "{{ craft.app.config.general.csrfTokenName|e('js') }}"; window....
user avatar
3 votes
Accepted

Headless CraftCMS as mobile app backend, requiring login

You could make the CSRF token available via an element API endpoint, then submit the form with that; 'api/csrf-token' => [ 'elementType' => GlobalSet::class, 'paginate' => false, ...
user avatar
  • 2,437
2 votes

What's the best way to skip CSRF for plugin controllers?

Try to disable the CSRF protection by event use Yii; use yii\base\ActionEvent; use yii\base\Event; use yii\web\Controller; Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (...
user avatar
2 votes

How do I test if Craft CSRF Protection is properly enabled?

After the page loads with the form loads, delete the CSRF cookie, then submit the form. It should fail CSRF token validation.
user avatar
  • 66.4k
2 votes

Does CSRF protection for controller actions require POST?

Chris is quite correct – CSRF does not work with GET requests (see this answer by Brad Bell for an explanation). I'm posting my workaround as an additional answer in case anyone else ever needs to ...
user avatar
2 votes
Accepted

Does CSRF protection for controller actions require POST?

According to https://craftcms.com/support/csrf-protection CSRF does require POST requests With CSRF protection enabled, all of your site’s visitors will get a “CRAFT_CSRF_TOKEN” cookie set on their ...
user avatar
  • 856
2 votes

How can I Prevent CSRF Tokens from being Cached?

I was just looking for a way to do something similar without Javascript. Someone has released a cache escaping extension giving you the ability to wrap content you want esacped with a {% nocache %} ...
user avatar
  • 373
2 votes
Accepted

In a plugin, what's the way in PHP to output a CSRF token?

Maybe try craft()->request->getCsrfToken(), see if that does it? Edit Sorry, misunderstood the question, since you are saying your plugin has a CP section then i'm assuming you're actually ...
user avatar
  • 4,519
2 votes

Login - Bad Request: The CSRF token could not be verified

Once the same problem happened for me because of server caching and it may happen because of client-side cookie/cache. Sometimes, server caching will cache the entire form including CSRF token. So if ...
user avatar
  • 121
2 votes

Login - Bad Request: The CSRF token could not be verified

I have exactly the same issue, clearing cookies worked for me
user avatar
  • 21
2 votes
Accepted

Delete CSRF cookie on submit form success

I guesss this could be accomplished using the cookies plugin or a simple jquery cookies library like js-cookie. This is how you would go about it with the cookies plugin: set the cookies name without ...
user avatar
  • 858
2 votes
Accepted

CSRF admin Login

the CSRF field its a hidden field not part of the form attributes. You don't have to manually type it, craft twig comes with {{ getCsrfInput() }} that recreates a hidden field between the <form><...
user avatar
  • 176
2 votes

AJAX CSRF Producing Inconsistent Results

Trying to understand the issue in general. These are my thoughts, not sure if they will help you. I assume that by caching, you mean some sort of full page cache and the comments below are based on ...
user avatar
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible