CODEWITHSUNDEEP
securitywebyiicsrf
Varun Jain
Varun Jain

Reputation: 1911

Cross-site request forgery Yii ,PHP

I am trying to implement CSRF validation in yii . I have written my own class and everything works fine except the fact that my post variable(for the form) does not consist of the token . Am I supposed to set the token myself in the post variable ? Yii documentation states that the post variable is set by a hidden field in every form . Does it require further implementation in the forms as well ? I know the token is not there as I saw the Post variables by dumping them .

Upvotes: 0

Views: 1905

Answers (2)

acorncom
acorncom

Reputation: 5955

In addition to enabling CSRF validation, you need to put the Yii CSRF token in your form. One of the easiest ways I've run into to put it in is to use CHtml beginForm, which puts it in as part of producing your form tag. More info here: http://www.yiiframework.com/doc/api/1.1/CHtml#beginForm-detail

Upvotes: 0

rinat.io
rinat.io

Reputation: 3188

I guess everything you need is enable CSRF validation in your config and use CHtml for forms (Yii Guide). Here what you need in config:

'components'=>array(
    'request'=>array(
        'enableCsrfValidation'=>true,
    ),
),

Upvotes: 1

Related Questions