Symfony2 and cross site POST request => empty data

Question

I'm trying to send a XML string to a controller using winhttp.winhttprequest.5.1 from a remote server via POST. Doing so on my dev machine runs perfectly fine (hosting client and server on the same machine, same IP). Nevertheless, when my application is deployed on the production server, the POST array is empty.

I think it might be due to CSRF protection, but even if I disable it in config.yml, my controller still get empty data. So, I'm quite stuck right here, would appreciate any help.

Sending data using winhttp.winhttprequest.5.1

loObj.Open("POST", url, .F.)
loObj.SetRequestHeader("Content-Type", "application/x-www-form-urlencoded")
loObj.Send("lcFile=" + parsedContent)

Symfony2 Controller :

public function getStockFromLogisticsXMLStringAction(Request $request)
{
    $request = $this->get('request');

    $xml = "";
    $output = $this->get('webservice.response');

    if ($request->getMethod() == 'POST') 
        $xml = $request->request->get('lcFile');
...
}

Request dump :

Dev machine : [request] => Symfony\Component\HttpFoundation\ParameterBag Object (
[parameters:protected] => Array (
[lcFile] => A1005LNBsLNBs5false2013-05-30T12:06:52201 blablabla
Prod machine : [request] => Symfony\Component\HttpFoundation\ParameterBag Object (
[parameters:protected] => Array ( ) )
[query] => Symfony\Component\HttpFoundation\ParameterBag Object (
[parameters:protected] => Array

Both environment are running Apache with PHP 5.4.

The fact I'm suspecting some CSRF protection issue is that if I send the exact same XML string to a pure PHP script on the production server dumping the POST data into a file, it works. If I send those datas to a Symfony controller, the request is empty...

Thank you.

Do you get a 200 HTTP response code or are there any general errors (e.g. routing...) — sebbo, May 08 '14 at 11:33
It is a 200 HTTP response. Not any errpr of any type. It really just is an empty POST array... — David B., May 08 '14 at 11:36
$xml is checked after $request->request->get(). For purpose test, var_dump indeed. — David B., May 08 '14 at 12:06
Could you try to var_dump the $request->request object. Just to check if there is no request body at all. — sebbo, May 08 '14 at 12:13
Double checked, just for you, put the result in the main question :) — David B., May 08 '14 at 13:05
Does the production system differ from your dev environment? Apache? Nginx? ...? — sebbo, May 08 '14 at 13:28
Very strange. One last idea - could you check if file_get_contents("php://input"); is also empty? — sebbo, May 08 '14 at 14:09
It is also empty. Very strange indeed... Thanks for trying though — David B., May 08 '14 at 14:24
let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/52319/discussion-between-sebbo-and-david-b) — sebbo, May 08 '14 at 14:41
just a thought, but did you clear your symfony cache after making the change on the prod server? any changes made in `prod` mode require you to clear your cache for the change to take effect. — Sehael, May 08 '14 at 21:13

David B. · Accepted Answer · 2017-02-19T22:05:51.453

2

Using OVH as a production server, it set a http firewall unabling to send POST data to controllers (.ovhconfig on root directory). Removing or setting it right allowed me to send those data.

 http.firewall=none

Thanks for helping anyway.

edited Feb 19 '17 at 22:05

answered May 12 '14 at 10:12

David B.

169
3
13

Could you please explain how did you remove or set the firewall right in order to get POST data properly ? – matdev Feb 18 '17 at 03:48
1

You are a really lucky I could get a hand on this old project. I updated the reply accordingly. Hope this helps. – David B. Feb 19 '17 at 22:07
Thanks David for digging that out. However, this is no solution for me: I still get empty data in my controller when sending POST data. It works fine when I run the web server on localhost though, weird. – matdev Feb 20 '17 at 09:32
This project was a one-shot and I don't work with OVH anymore for this kind of troubles. Neither did I work with Symfony again.Nevertheless, what is the PHP version on your server vs PHP version on your dev machine ? Can you get POST data in plain old PHP (without Symfony) on your prod environment ? – David B. Feb 20 '17 at 10:03
Another cause might be the url rewrite. As mentionned here : http://stackoverflow.com/a/1631999/1156542 – David B. Feb 20 '17 at 10:07

Symfony2 and cross site POST request => empty data

1 Answers1

Linked