CSRF token mismatch in post request in 3.6 version

Question

I have two different apps of cakephp. One has a version 3.5 and other 3.6.

When i used and built 3.5 app i did not have a problem of CSRF matching in post request. But now as i am using 3.6 it is giving me error of CSRF token.

Although in both app's AppController, CSRF component is disable.

//$this->loadComponent('Csrf');

i am using simple post request like this:

$.ajax({
        type: "POST",
        url: "../user/my_action",
        dataType: 'json',
        success: function (data) {
            set_data(data.response);
        }
    });

What am i missing? or some configuration i have done wrong?

Try to remove your cookies and cache. – Sehdev Aug 19 '18 at 11:04 — Sehdev, Aug 19 '18 at 11:04

ndm · Accepted Answer · 2018-08-19T18:03:16.983

21

The latest 3.6 application template now uses the CSRF middleware by default, see your apps src/Application.php file. Unfortunately this change hasn't been documented properly, and hit people by surprise.

Ideally you do not disable it, but instead pass the proper CSRF token alongside with your AJAX requests, you can easily obtain the token from the request object in your view templates, for example in the layout to make it globally available:

<script>
var csrfToken = <?= json_encode($this->request->getParam('_csrfToken')) ?>;
// ...
</script>

You can then easily use it in your AJAX requests:

$.ajax({
    headers: {
        'X-CSRF-Token': csrfToken
    },
    // ...
});

See also

edited Aug 19 '18 at 18:03

answered Aug 19 '18 at 10:58

ndm

59,784
9
71
110

ndm sorry for late, your solution works very well. problem i am getting is ajax url. due to change in the ajax post requests i think they have also changed how the url is made in ajax. – fat potato Aug 28 '18 at 08:51
it did not append the site url automatically while i was using 3.5 cake. ../controller/action was workign fine. it have to do something with csrf ?? – fat potato Aug 28 '18 at 08:52
@fatpotato No, what the URLs need to look like has nothing to do with CSRF protection. You should use [**`Router::url()`**](https://book.cakephp.org/3.0/en/development/routing.html#generating-urls) or [**the URL helper**](https://book.cakephp.org/3.0/en/views/helpers/url.html) (requires disabling escaping when used for JS) to build proper root relative URLs. – ndm Aug 28 '18 at 10:38
i should pass this url to the ctp file and then catch it in the js file? – fat potato Aug 28 '18 at 11:10
@fatpotato Just like you'd do it with the token, yes. – ndm Aug 28 '18 at 11:28

score 4 · Answer 2 · edited Oct 10 '18 at 08:26

4

Add this code on your $.ajax() function call:

beforeSend: function (xhr) { // Add this line
        xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
 },  // Add this line

edited Oct 10 '18 at 08:26

Sehdev

5,486
3
11
34

answered Sep 28 '18 at 03:27

SnguyenOne

141
1
2

score 2 · Answer 3 · answered Nov 01 '19 at 12:02

2

For CakePHP 3.8, this worked for me. In config\routes.php comment the line as so :

//$routes->applyMiddleware('csrf');

answered Nov 01 '19 at 12:02

levolutionniste

424
1
6
16

1

Thanks for answer . Although this is another approach but you should not disable it. as this is the basic and major security measure. – fat potato Nov 15 '19 at 17:24

score 1 · Answer 4 · answered Feb 27 '19 at 13:52

1

i had the same error, without using ajax, the problem was that admin theme was not using cakephp 3 form helper sintax, it was html.

after i changed with Form->create() ?> Form->end() ?> it worked fine

answered Feb 27 '19 at 13:52

Stanescu Gheorghe

21
1

work for me, but needs in $.ajax call: beforeSend: function (xhr) { xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val()); }, – Thiago Sathler Sep 06 '19 at 18:33

CSRF token mismatch in post request in 3.6 version

4 Answers4

Linked