We have moved our forum to GitHub Discussions. For questions about Phalcon v3/v4/v5 you can visit here and for Phalcon v6 here.
  1. Home
  2. Security

CSRF doesnt work

In my view I have

<input type="hidden" name="<?php echo $this->security->getTokenKey() ?>" value="<?php echo $this->security->getToken() ?>"/>

in my controller I have 

echo "<pre>";
        print_r(var_dump($this->security->checkToken()));
        echo "</pre>";
        exit;

which returns false.

Now i added this in my apache config 

RedirectMatch 204 /robots.txt
RedirectMatch 204 /favicon.ico

and in my debugger, for favicon it says 204.

if inside the view i print my session I get

Array
(
    [$PHALCON/CSRF$] => MDmkpUWC6qN5KAtt
    [$PHALCON/CSRF/KEY$] => Aw821s5pNwq6IPsG
)

and if I inspect the hidden element, those are the name and the value of the input. However once I click "submit" , inside the controller if I print the Session again, I get complatyly different values

Multi module app

in my application.php file I have

use \Phalcon\Session\Adapter\Files as SessionAdapter;
$this->di->set('session', function () {

            $session = new SessionAdapter();
            $session->start();

            return $session;

        }, true);

Phalcon 2.1.x



85.5k

aditional test:

even if I do


$this->security->getTokenKey();
        $this->security->getToken();

        echo "<pre>";
        print_r(var_dump($this->security->checkToken()));
        echo "</pre>";
        exit;

still doesnt work



20.4k
edited Oct '15

It sounds like you are regenerating the token somewhere else, outside your form. Any time you call getTokenKey() or getToken() it will regenerate. checkToken() will return either true or false. In your last example the session hasn't been updated before you check it. I think the tokens are saved in flash session, so they are a one hit wonder, so need to be passed direct to the controller via post, with out any interruption. So it seems you are either duplicating the token somewhere, or you are not posting direct to the method containing the check.



85.5k

I actually open an issue on github https://github.com/phalcon/cphalcon/issues/11009 , because this code works in master branch



51.3k


85.5k

I saw your post while I was searching for solution. But i am not keen on the idea. The token should be destroyed after every try ( at least in my opinion ).

Otherwise I think it sohuld work. But it seems like there are some problems with 2.1's tokens.



145.0k

To be honest - just implement your own csrf protection, its not so hard, i have my own cuz didnt checked this built in and i have no problems :P



20.4k
in reply to Wojciech Ślawski

But why make your own when it's built in to Phalcon? It's quite easy to make your own function if you want, but if it's built in, it should work and be usable :) I didn't realize at first that OP was using beta version, so it would seem they may have found a bug, rather than looking for some way of implimenting it.

To be honest - just implement your own csrf protection, its not so hard, i have my own cuz didnt checked this built in and i have no problems :P