CSRF token mismatch in post request in 3.6 version

问题

I have two different apps of cakephp. One has a version 3.5 and other 3.6.

When i used and built 3.5 app i did not have a problem of CSRF matching in post request. But now as i am using 3.6 it is giving me error of CSRF token.

Although in both app's AppController, CSRF component is disable.

//$this->loadComponent('Csrf');

i am using simple post request like this:

$.ajax({
        type: "POST",
        url: "../user/my_action",
        dataType: 'json',
        success: function (data) {
            set_data(data.response);
        }
    });

What am i missing? or some configuration i have done wrong?

回答1:

The latest 3.6 application template now uses the CSRF middleware by default, see your apps src/Application.php file. Unfortunately this change hasn't been documented properly, and hit people by surprise.

Ideally you do not disable it, but instead pass the proper CSRF token alongside with your AJAX requests, you can easily obtain the token from the request object in your view templates, for example in the layout to make it globally available:

<script>
var csrfToken = <?= json_encode($this->request->getParam('_csrfToken')) ?>;
// ...
</script>

You can then easily use it in your AJAX requests:

$.ajax({
    headers: {
        'X-CSRF-Token': csrfToken
    },
    // ...
});

回答2:

Add this code on your $.ajax() function call:

beforeSend: function (xhr) { // Add this line
        xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
 },  // Add this line

回答3:

For CakePHP 3.8, this worked for me. In config\routes.php comment the line as so :

//$routes->applyMiddleware('csrf');

回答4:

i had the same error, without using ajax, the problem was that admin theme was not using cakephp 3 form helper sintax, it was html.

after i changed with Form->create() ?> Form->end() ?> it worked fine

来源：https://stackoverflow.com/questions/51916680/csrf-token-mismatch-in-post-request-in-3-6-version

标签

cakephp

cakephp-3.0

csrf