CSRF disabled API

Good morning,

I'm having trouble isolating the CSRF protection to just my pages.

I would like this check not to be done for the API, but I came across this conflict:

Code:

public $globals = [
        'before' => [
            'autorizacao' => [
                'except' => [
                    'dashboard/login',
                    'ajax/usuario/login',
                    'dashboard/esqueceu-senha',
                    'api/*'
                ]
            ],
            'csrf' => [ // THIS RULE IS NOT WORKING
                'except' => [
                    'api/*'
                ]
            ],
        ],
        'after' => [
            'toolbar',
        ],
    ];

It seems to me that there is a conflict that this rule:

Code:

public $methods = [
        'post' => ['csrf']
    ];

because the "api/*" endpoints are always checked due to the "method" being set to "post".

I made a change in the sources of the script "system/Filters/Filters.php", so that you can review the "excepts" before running the Filters:

Code:

public function initialize(?string $uri = null)
    {
        if ($this->initialized === true) {
            return $this;
        }

        $this->processGlobals($uri);
        $this->processMethods();
        $this->processFilters($uri);
        $this->processExceptGlobals($uri); // <- ADD METHOD

        // Set the toolbar filter to the last position to be executed
        if (in_array('toolbar', $this->filters['after'], true)
            && ($count = count($this->filters['after'])) > 1
            && $this->filters['after'][$count - 1] !== 'toolbar'
        ) {
            array_splice($this->filters['after'], array_search('toolbar', $this->filters['after'], true), 1);
            $this->filters['after'][] = 'toolbar';
        }

        $this->processAliasesToClass('before');
        $this->processAliasesToClass('after');

        $this->initialized = true;

        return $this;
    }

I created this method:

Code:

protected function processExceptGlobals(?string $uri = null)
    {
        if (isset($this->config->globals['before'])) {

            $uri = strtolower(trim($uri ?? '', '/ '));
           
            foreach ($this->config->globals['before'] as $alias => $rules) {
                if (is_array($rules) && isset($rules['except'])) {   
                    $check = $rules['except'];
                    if ($this->pathApplies($uri, $check)) {
                        foreach($this->filters['before'] as $alias2 => $rules2){
                            if ($rules2 == $alias) unset($this->filters['before'][$alias2]);
                        }
                    }
                }
            }

        }
    }

You should never modify system files! If you need to make changes extend the system file classes.

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

If you set csrf in $global, you don't need to set it $methods.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper