Welcome Guest, Not a member yet? Register   Sign In
CSRF except filter is not working
#1

I am trying to set up a webhook for Stripe and I have my route for that set to `/subscription/webhooks`. I've added this URI to my CSRF except filter: 

Code:
    public $globals = [
        'before' => [
          'csrf' => ['except' => ['subscription/webhooks']],
        ],
    ];
 
This doesn't work. I've tried creating a test form with 
PHP Code:
<?= csrf_field() ?>  
submitting to that same URI and that works, but when I remove the 
PHP Code:
<?= csrf_field() ?>  
it throws a 403 response.
CI version: 4.4.1
Local server: nginx
Reply
#2

CSRF filter set up in "after"?
See command https://codeigniter4.github.io/userguide...lter-check
Reply
#3

The documentation says to put the csrf filter with the except array in 'before'. I ran the spark command to see what filters are running for that URI and it is still showing csrf being run. Even if I comment out the csrf line altogether, it is still being run. Where else could this be coming from?
Reply
#4

Probaly subscription/webhooks/* as pattern?
Reply
#5

(10-24-2023, 08:24 AM)ozornick Wrote: Probaly subscription/webhooks/* as pattern?

When I add that I get csrf twice when I run the spark filter:check command 

Code:
+--------+-----------------------+----------------+---------------+
| Method | Route                | Before Filters | After Filters |
+--------+-----------------------+----------------+---------------+
| POST  | subscription/webhooks | csrf csrf      |              |
+--------+-----------------------+----------------+---------------+
Reply
#6

(This post was last modified: 10-24-2023, 03:14 PM by kenjis.)

> Where else could this be coming from? 

In a route?
https://codeigniter4.github.io/CodeIgnit...ng-filters
Reply
#7

(10-24-2023, 03:14 PM)kenjis Wrote: > Where else could this be coming from? 

In a route?
https://codeigniter4.github.io/CodeIgnit...ng-filters

Here is the route for this URI

Code:
$routes->post("subscription/webhooks","App\Subscription::webhooks");

With this after all the other routes. 
Code:
service('auth')->routes($routes);

The isn't any CSRF filter on any of my routes in `Config/Routes.php`
Reply




Theme © iAndrew 2016 - Forum software by © MyBB