Welcome Guest, Not a member yet? Register   Sign In
csrf_protection in codeigniter 2.0.2
#1

[eluser]zoreli[/eluser]
Hi everyone

I have simple login form in codeigniter (2.0.2). Frequently the following error is displayed:

An Error Was Encountered
The action you have requested is not allowed.


After short research I undertand that it is security issue connected with csrf_protection

In the config file my setting is the following:

Code:
$config['csrf_protection'] = TRUE;

My login form is open and closed with use of short tags, like this:

Code:
<?= form_open("/mycontroller/checklogin/process", array("method"=>"post","class"=>"login_form")) ?>

and I am closing the form like this:

Code:
<?= form_close() ?>

Reading on this forum for similar issues I found this solution, which when I implement it, didn't solve my problem:

Code:
<?=form_hidden($this->security->get_csrf_token_name(), $this->security->get_csrf_hash());?>

Error reamin. I am not checking this hidden field in my controller...Have no idea should I??

I also do not run form validation library in my controller. Should I?

Any help will be deeply appreciated.

Regards, Zoreli


Messages In This Thread
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 04:16 AM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 07:21 AM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 06:12 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 06:16 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 06:23 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 06:34 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-11-2012, 08:01 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-12-2012, 02:07 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-12-2012, 02:27 PM
csrf_protection in codeigniter 2.0.2 - by El Forum - 07-13-2012, 12:39 AM



Theme © iAndrew 2016 - Forum software by © MyBB