Tuesday, 27 January 2015

Yii2: Using csrf token

First, if you do not understand what is the CSRF token? and why should we use it, please refer to the following link :
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

One of the new features of Yii2 is CSRF validation enabled by default.
If you use ajax or basic form as follows :

<form action='#' method='POST'>
    ...........
</form>

You will get an error exception :

Bad Request (#400): Unable to verify your data submission

That is because you do not submit csrf token. The easiest way if you dont care about csrf just disable it in main config :

'components' => [
     'request' => [
          ....
          'enableCsrfValidation'=>false,
      ],
      .....
],

Or in Controller :

public function beforeAction($action) {
    $this->enableCsrfValidation = false;
    return parent::beforeAction($action);
}

So how to use Csrf Validation for your strong security website:

* With basic form:
- Create form with yii\widgets\ActiveForm or yii\bootstrap\ActiveForm
ActiveForm will automatically add a token in the form

Can use like this

<?php $form = ActiveForm::begin(['id' => 'login-form']); ?>
    <?= $form->field($model, 'username') ?>
    <?= $form->field($model, 'password')->passwordInput() ?>
    ....
<?php ActiveForm::end(); ?>

Or

<?php $form = ActiveForm::begin(['id' => 'login-form']); ?>
      <input type='text' name='name'/>
      .........
<?php ActiveForm::end(); ?>

* With manual form:
you must manually add CSRF token in the form

<form action='#' method='POST'>
   <input type="hidden" name="_csrf" value="<?=Yii::$app->request->getCsrfToken()?>" />
   ....
</form>

* With Ajax
- In main layout add csrfMetaTags :
<head>
   .......
   <?= Html::csrfMetaTags() ?>
</head>

- And in javascript ajax code add csrf param like this:

var csrfToken = $('meta[name="csrf-token"]').attr("content");
$.ajax({
         url: 'request',
         type: 'post',
         dataType: 'json',
         data: {param1: param1, _csrf : csrfToken},
});

Related Posts:

  • Yii2: Using csrf tokenFirst, if you do not understand what is the CSRF token? and why should we use it, please refer to the following link : https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) One of the new features of Yii2 is CSRF… Read More
  • Yii2: Validate value without model (Ad Hoc Validation) Sometimes you need to do ad hoc validation for values that are not bound to any model. If you only need to perform one type of validation (e.g. validating email addresses), you may call the [[yii\validators\Valida… Read More
  • Yii2: createUrl methodOld Yii1 to create an url we write: $this->createUrl();  or Yii::app()->createUrl(); Now with Yii2 we have to write \Yii::$app->getUrlManager()->createUrl(['controler/action','param1'=>'value1','pa… Read More
  • Yii2: PHP Warning - Unable to allocate memory for poolYii2 error: PHP Warning – yii\base\ErrorException include(): Unable to allocate memory for pool. * Reason : You have not allocated enough memory for APC cache (file cache or opcode cache) * Solution 1: Disable APC,&n… Read More
  • Yii2: Validate unique if attribute is not emptyYii2 unique validator, empty string and null is treated the same and ignored. It not the same as mysql when only null value ignored in unique check. But this is not a bug, not all database management systemare the same w… Read More

10 comments:

  1. Blogger24 April 2015 at 06:01

    Thanks very much. This is the one solution Im looking for.

    ReplyDelete
  2. Anonymous26 May 2015 at 18:36

    thanks for this solution

    ReplyDelete
  3. Anonymous28 May 2015 at 09:40

    Thanks, exactly what I needed!

    ReplyDelete
  4. Ведамиръ18 September 2015 at 02:51

    very very very thx =)

    ReplyDelete
  5. Unknown9 December 2015 at 01:01

    thanks you very much

    ReplyDelete
  6. Anonymous9 December 2015 at 05:53

    ajax not working with type : 'post' but working on 'get', why

    ReplyDelete
  7. Unknown8 February 2016 at 05:07

    Great post!

    It is very informative and helpful code of csrf token

    ReplyDelete
  8. Anonymous16 June 2016 at 08:31

    Great Info! Thanks.

    ReplyDelete
  9. Melbourne Web Hosting22 March 2017 at 00:40

    Your blog has given me that thing which I never expect to get from all over the websites. Nice post guys!

    ReplyDelete
  10. Aleksandar Belic Aleksanchez30 May 2018 at 02:56

    Very helpful, thanx!

    ReplyDelete