The action you have requested is not allowed. even without csrf protection

Question

In my codeigniter project.CSRF protection is not set true.But when I submit a form i got following error "An Error Was Encountered The action you have requested is not allowed.". It is my form view

<?php echo form_open('business/add-user',array('class'=>'form-horizontal'));?>
                                <div class="form-group">

                    <input type="hidden" name="<?php echo $this->security->get_csrf_token_name();?>" value="<?php echo $this->security->get_csrf_hash();?>">

                                    <label class="col-md-2 control-label">User Name<span

                                                class="text-danger">*</span></label>

                                    <div class="col-md-7">
                                        <input type="hidden" name="business_id" 
                                        value="<?php echo $business_id;?>">
                                        <input class="form-control" type="text" id="name"

                                               value="<?php echo set_value('name'); ?>" name="name"

                                               placeholder="User Name">

                                        <div style="margin-top: 0px; color: red;"><?= form_error('name'); ?></div>

                                    </div>

                                </div>

                                <div class="form-group">

                                    <label class="col-md-2 control-label">Email Address<span

                                                class="text-danger">*</span></label>

                                    <div class="col-md-7">

                                        <input class="form-control" type="email" id="email"

                                               value="<?php echo set_value('email'); ?>" name="email"

                                               placeholder="Email Address">

                                        <div style="margin-top: 0px; color: red;"><?= form_error('email'); ?></div>

                                    </div>

                                </div>

                                <div class="form-group">

                                    <label class="col-md-2 control-label">Phone<span class="text-danger">*</span></label>

                                    <div class="col-md-7">

                                        <input class="form-control" type="number" id="phone"

                                               value="<?php echo set_value('phone'); ?>" name="phone"

                                               placeholder="Phone">

                                        <div style="margin-top: 0px; color: red;"><?= form_error('phone'); ?></div>

                                    </div>

                                </div>

                                <div class="form-group">

                                    <label class="col-md-2 control-label">Password<span class="text-danger">*</span></label>

                                    <div class="col-md-7">

                                        <input class="form-control" type="password" id="password"

                                               value="<?php echo set_value('password'); ?>" name="password"

                                               placeholder="Password">

                                        <div style="margin-top: 0px; color: red;"><?= form_error('password'); ?></div>

                                    </div>

                                </div>
                                <div class="form-group">

                                    <div class="col-md-8 col-md-offset-2">

                                        <button class="btn btn-sm btn-primary" name="submit" type="submit"><i

                                                    class="fa fa-check"></i> Add User

                                        </button>

                                    </div>

                                </div>

                            <?php echo form_close();?>

My controller

        public function add_user()
{
    $this->form_validation->set_rules('name','Name','required|xss_clean');
    $this->form_validation->set_rules('email','Email','required|xss_clean|valid_email|is_unique[user_login.email]');
    $this->form_validation->set_rules('phone','Phone','required|xss_clean|is_unique[user_login.phone]');
    $this->form_validation->set_rules('password','Password','required|xss_clean');
    $this->form_validation->set_error_delimiters('','');
    if($this->form_validation->run()===FALSE)
    {
        $data['business_id']=$this->input->post('business_id');
        $this->load->view('admin/business/create_user',$data);
    }

    else
    {
        if($this->Business_Model->add_user())
        {
            redirect('account/business-profile/'.$this->input->post('business_id'));
        }

        else
        {
            $this->session->set_flashdata('SUCCESSMSG','User not created');
            $data['business_id']=$this->input->post('business_id');
            $this->load->view('admin/business/create_user',$data);
        }
    }
}

action of the form rooted as $route['business/add-user']='admin/Business/add-user';

i.e forms action is add_user in controller I need to overcome this issue

Answer 1

I could fix it.Issue was action of the form I given is business/add-user.This route is configured in routes.php file.In xampp there is no issues.But in server when I submit form "The action you have requested is not allowed" error occured.So I cahnged form action into default route "admin/Business/add-user".Thus error fixed

Answer 2

Try removing <input type="hidden" name="<?php echo $this->security->get_csrf_token_name();?>" value="<?php echo $this->security->get_csrf_hash();?>"> I'm not 100% sure if this is causing the issue.

form_open already adds a hidden field with the csrf token for you!