Welcome Guest, Not a member yet? Register   Sign In
CSRF and double posting
#5

(This post was last modified: 06-20-2016, 04:13 PM by PaulD. Edit Reason: Added PS / Added PPS )

Ok, so I reverted to some jquery but it seems daft.  Dodgy

Code:
<script>
  $('input[type=submit]').click(function(event){
        event.preventDefault;
        $('input[type=submit]').attr('disabled','disabled');
        $('form#addForm').submit();
  });
</script>

Before I did that though I turned on information logging, and this is what the log had in it: (Have highlighted two lines in particular)

Quote:INFO - 2016-06-19 10:25:53 --> Config Class Initialized
INFO - 2016-06-19 10:25:53 --> Hooks Class Initialized
INFO - 2016-06-19 10:25:53 --> Utf8 Class Initialized
INFO - 2016-06-19 10:25:53 --> URI Class Initialized
INFO - 2016-06-19 10:25:53 --> Router Class Initialized
INFO - 2016-06-19 10:25:53 --> Output Class Initialized
INFO - 2016-06-19 10:25:53 --> Security Class Initialized
INFO - 2016-06-19 10:25:53 --> CSRF cookie sent
INFO - 2016-06-19 10:25:53 --> CSRF token verified
INFO - 2016-06-19 10:25:53 --> Input Class Initialized
INFO - 2016-06-19 10:25:53 --> Language Class Initialized
INFO - 2016-06-19 10:25:53 --> Loader Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: url_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: form_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: security_helper
INFO - 2016-06-19 10:25:53 --> Database Driver Class Initialized
INFO - 2016-06-19 10:25:53 --> Session: Class initialized using 'database' driver.
INFO - 2016-06-19 10:25:53 --> Form Validation Class Initialized
INFO - 2016-06-19 10:25:53 --> Email Class Initialized
INFO - 2016-06-19 10:25:53 --> Language file loaded: language/english/ion_auth_lang.php
INFO - 2016-06-19 10:25:53 --> Helper loaded: cookie_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: language_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: date_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Controller Class Initialized
INFO - 2016-06-19 10:25:53 --> Language file loaded: language/english/form_validation_lang.php
INFO - 2016-06-19 10:25:53 --> Config Class Initialized
INFO - 2016-06-19 10:25:53 --> Hooks Class Initialized
INFO - 2016-06-19 10:25:53 --> Utf8 Class Initialized
INFO - 2016-06-19 10:25:53 --> URI Class Initialized
INFO - 2016-06-19 10:25:53 --> Router Class Initialized
INFO - 2016-06-19 10:25:53 --> Output Class Initialized
INFO - 2016-06-19 10:25:53 --> Security Class Initialized
INFO - 2016-06-19 10:25:53 --> CSRF cookie sent
INFO - 2016-06-19 10:25:53 --> CSRF token verified
INFO - 2016-06-19 10:25:53 --> Input Class Initialized
INFO - 2016-06-19 10:25:53 --> Language Class Initialized
INFO - 2016-06-19 10:25:53 --> Loader Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: url_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: form_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: security_helper
INFO - 2016-06-19 10:25:53 --> Database Driver Class Initialized
INFO - 2016-06-19 10:25:53 --> Session: Class initialized using 'database' driver.
INFO - 2016-06-19 10:25:53 --> Form Validation Class Initialized
INFO - 2016-06-19 10:25:53 --> Email Class Initialized
INFO - 2016-06-19 10:25:53 --> Language file loaded: language/english/ion_auth_lang.php
INFO - 2016-06-19 10:25:53 --> Helper loaded: cookie_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: language_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: date_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Controller Class Initialized
INFO - 2016-06-19 10:25:53 --> Language file loaded: language/english/form_validation_lang.php
INFO - 2016-06-19 10:25:53 --> Config Class Initialized
INFO - 2016-06-19 10:25:53 --> Hooks Class Initialized
INFO - 2016-06-19 10:25:53 --> Utf8 Class Initialized
INFO - 2016-06-19 10:25:53 --> URI Class Initialized
INFO - 2016-06-19 10:25:53 --> Router Class Initialized
INFO - 2016-06-19 10:25:53 --> Output Class Initialized
INFO - 2016-06-19 10:25:53 --> Security Class Initialized
INFO - 2016-06-19 10:25:53 --> CSRF cookie sent
INFO - 2016-06-19 10:25:53 --> Input Class Initialized
INFO - 2016-06-19 10:25:53 --> Language Class Initialized
INFO - 2016-06-19 10:25:53 --> Loader Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: url_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: form_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: security_helper
INFO - 2016-06-19 10:25:53 --> Database Driver Class Initialized
INFO - 2016-06-19 10:25:53 --> Session: Class initialized using 'database' driver.
INFO - 2016-06-19 10:25:53 --> Form Validation Class Initialized
INFO - 2016-06-19 10:25:53 --> Email Class Initialized
INFO - 2016-06-19 10:25:53 --> Language file loaded: language/english/ion_auth_lang.php
INFO - 2016-06-19 10:25:53 --> Helper loaded: cookie_helper
INFO - 2016-06-19 10:25:53 --> Helper loaded: language_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Helper loaded: date_helper
INFO - 2016-06-19 10:25:53 --> Model Class Initialized
INFO - 2016-06-19 10:25:53 --> Controller Class Initialized
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/common/private/header_view.php
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/common/private/page_title_view.php
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/common/book/contents_menu_view.php
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/pages/contents_view.php
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/common/book/page_close_view.php
INFO - 2016-06-19 10:25:53 --> File loaded: /home/sites/xxx.co.uk/public_html/application/views/common/private/footer_view.php
INFO - 2016-06-19 10:25:53 --> Final output sent to browser

As you can see, it does seem to be running twice. (This log I got by going to the page with the form in question, emptied the log file, did a quick double click, two records were created erroneously, and this was the log. I have highlighted where the token seems to be being verified twice.

I did not know what to do about this so used jquery, as I said earlier, but it feels a bit hacky. However, since this is a user side issue, I suppose it is ok. But why the regenerated token does not kick in I don't know. I tried resetting validation on the form after passing but that didn't help either.

So solved, but still not happy with just the JS solution. I would really like to know why the double post happened and the session seems to think it was one action, not two.

If anyone could shed any light, would be very pleased. In the meantime, and not immediately as I am not overly happy, am going to have to go through adding this silly jquery snippet to every form (and there are loads of them of course - virtually every page).

Paul.
Sad

PS I suddenly thought it might be the browser. So I went to IE instead of chrome and this fast double click/double post does not happen on IE. Perhaps this is just a chrome issue.

PPS Just installed Firefox and it does not happen in Firefox either - what is going on???
BTW The latest version of firefox is soooooo fast - I am really impressed not having used it for some time. Much quicker than chrome. I might start using it as my default. :-)
Reply


Messages In This Thread
CSRF and double posting - by PaulD - 06-18-2016, 11:03 PM
RE: CSRF and double posting - by skunkbad - 06-19-2016, 12:05 AM
RE: CSRF and double posting - by John_Betong - 06-20-2016, 09:25 PM
RE: CSRF and double posting - by skunkbad - 06-20-2016, 10:55 PM
RE: CSRF and double posting - by PaulD - 06-19-2016, 12:43 AM
RE: CSRF and double posting - by PaulD - 06-19-2016, 01:00 AM
RE: CSRF and double posting - by PaulD - 06-19-2016, 03:19 AM
RE: CSRF and double posting - by skunkbad - 06-19-2016, 09:30 AM
RE: CSRF and double posting - by PaulD - 06-19-2016, 03:06 PM
RE: CSRF and double posting - by skunkbad - 06-19-2016, 03:35 PM
RE: CSRF and double posting - by PaulD - 06-19-2016, 05:59 PM
RE: CSRF and double posting - by spjonez - 06-20-2016, 11:18 AM
RE: CSRF and double posting - by Narf - 06-20-2016, 12:26 PM
RE: CSRF and double posting - by spjonez - 06-20-2016, 12:37 PM
RE: CSRF and double posting - by Narf - 06-20-2016, 01:49 PM
RE: CSRF and double posting - by spjonez - 06-20-2016, 02:32 PM
RE: CSRF and double posting - by PaulD - 06-20-2016, 01:46 PM
RE: CSRF and double posting - by PaulD - 06-20-2016, 04:02 PM
RE: CSRF and double posting - by spjonez - 06-20-2016, 07:00 PM
RE: CSRF and double posting - by Narf - 06-21-2016, 03:38 AM
RE: CSRF and double posting - by spjonez - 06-21-2016, 08:54 AM
RE: CSRF and double posting - by Narf - 06-22-2016, 05:14 AM
RE: CSRF and double posting - by Martin7483 - 06-23-2016, 03:35 AM



Theme © iAndrew 2016 - Forum software by © MyBB