CSRF - Multiple form CI 3.0 |
Hello
, I am new in using CodeIgniter and french .. sorry .. my english is just bad. I have a form within are inserted via the ajax 3 other forms. All these forms are generated with form_open_multipart function . My problème is that the CSRF_Token is the same for all this four forms ... So when one is submitted the others return 403 (normal) How can i be sure to create a différent token for each form ? My config file : $config['csrf_protection'] = TRUE; $config['csrf_token_name'] = 'csrf_valide_Token'; $config['csrf_cookie_name'] = 'csrf_valide_Cookie'; $config['csrf_expire'] = 7200; $config['csrf_regenerate'] = TRUE; $config['csrf_exclude_uris'] = array('/ajoutGalerie');
You should set
Code: $config['csrf_regenerate'] = FALSE; The token then wont be updated on each form submission (but will still be unique per visitor). Quote:Tokens may be either regenerated on every submission (default) or kept the same throughout the life of the CSRF cookie. The default regeneration of tokens provides stricter security, but may result in usability concerns as other tokens become invalid (back/forward navigation, multiple tabs/windows, asynchronous actions, etc). You may alter this behavior by editing the following config parameterhttps://www.codeigniter.com/user_guide/l...rgery-csrf (12-16-2015, 01:08 AM)Diederik Wrote: You should setPierrick thank you for your reply, My problem, if I understand the documentation, is the reverse. I would have to have several different token for each form of my page. They are treated individually with an ajax post . To be more precise this is my case,, if I submit an ajax forms with the others become invalid (erreur403) Merci Peirerik de ta réponse. Mon problème , si jai bien compris la documentation, est l'inverse. Il faudrait que j'ai plusieurs token différent pour chaque formulaire de ma page . Ils sont traités individuellement avec un post ajax . Pour être plus précis voici mon cas ![]() PHP Code: <?php echo form_open_multipart('Element/addElement', array('class' => 'form-horizontal', 'role' => 'form', 'id' => 'FrmElement', 'name' => 'FrmElement')); ?> for now I excluded the url of the controller PHP Code: $config['csrf_exclude_uris'] = array('Ajax_Loader_file/AjaxChgPhotoElement/[0-9]+'); |
Welcome Guest, Not a member yet? Register Sign In |