CODEWITHSUNDEEP
cakephpcakephp-3.0csrf
fat_potato
fat_potato

Reputation: 653

CSRF token mismatch in post request in 3.6 version

I have two different apps of cakephp. One has a version 3.5 and other 3.6.

When i used and built 3.5 app i did not have a problem of CSRF matching in post request. But now as i am using 3.6 it is giving me error of CSRF token.

Although in both app's AppController, CSRF component is disable.

//$this->loadComponent('Csrf');

i am using simple post request like this:

$.ajax({
        type: "POST",
        url: "../user/my_action",
        dataType: 'json',
        success: function (data) {
            set_data(data.response);
        }
    });

What am i missing? or some configuration i have done wrong?

Upvotes: 4

Views: 26992

Answers (5)

George Leon
George Leon

Reputation: 31

I hade the same situation with crsfToken have null value using this line

 csrfToken = document.querySelector('[name="_csrfToken"]').value;

so i replaced it with this line and now it's loading correctly

let     csrfToken = document.querySelector('[name="_csrfToken"]').value;

Upvotes: 0

levolutionniste
levolutionniste

Reputation: 424

For CakePHP 3.8, this worked for me. In config\routes.php comment the line as so : 

//$routes->applyMiddleware('csrf');

Upvotes: 2

Stanescu Gheorghe
Stanescu Gheorghe

Reputation: 21

i had the same error, without using ajax, the problem was that admin theme was not using cakephp 3 form helper sintax, it was html.

after i changed with Form->create() ?> Form->end() ?> it worked fine

Upvotes: 1

SnguyenOne
SnguyenOne

Reputation: 151

Add this code on your $.ajax() function call:

beforeSend: function (xhr) { // Add this line
        xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
 },  // Add this line

Upvotes: 4

ndm
ndm

Reputation: 60463

The latest 3.6 application template now uses the CSRF middleware by default, see your apps src/Application.php file. Unfortunately this change hasn't been documented properly, and hit people by surprise.

Ideally you do not disable it, but instead pass the proper CSRF token alongside with your AJAX requests, you can easily obtain the token from the request object in your view templates, for example in the layout to make it globally available:

<script>
var csrfToken = <?= json_encode($this->request->getParam('_csrfToken')) ?>;
// ...
</script>

You can then easily use it in your AJAX requests:

$.ajax({
    headers: {
        'X-CSRF-Token': csrfToken
    },
    // ...
});

See also

Upvotes: 22

Related Questions