Welcome Guest, Not a member yet? Register   Sign In
CSRF - Multiple form CI 3.0
#1

Hello
, I am new in using CodeIgniter and french .. sorry .. my english is just bad.
I have a form within are inserted via the ajax 3 other forms.
All these forms are generated with form_open_multipart function .
My problème is that the CSRF_Token is the same for all this four forms ...
So when one is submitted the others return 403 (normal)
How can i be sure to create a différent token for each form ?

My config file :
$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'csrf_valide_Token';
$config['csrf_cookie_name'] = 'csrf_valide_Cookie';
$config['csrf_expire'] = 7200;
$config['csrf_regenerate'] = TRUE;
$config['csrf_exclude_uris'] = array('/ajoutGalerie');
Reply
#2

You should set

Code:
$config['csrf_regenerate'] = FALSE;

The token then wont be updated on each form submission (but will still be unique per visitor).

Quote:Tokens may be either regenerated on every submission (default) or kept the same throughout the life of the CSRF cookie. The default regeneration of tokens provides stricter security, but may result in usability concerns as other tokens become invalid (back/forward navigation, multiple tabs/windows, asynchronous actions, etc). You may alter this behavior by editing the following config parameter
https://www.codeigniter.com/user_guide/l...rgery-csrf
Reply
#3

(12-16-2015, 01:08 AM)Diederik Wrote: You should set

Code:
$config['csrf_regenerate'] = FALSE;

The token then wont be updated on each form submission (but will still be unique per visitor).

Quote:Tokens may be either regenerated on every submission (default) or kept the same throughout the life of the CSRF cookie. The default regeneration of tokens provides stricter security, but may result in usability concerns as other tokens become invalid (back/forward navigation, multiple tabs/windows, asynchronous actions, etc). You may alter this behavior by editing the following config parameter
https://www.codeigniter.com/user_guide/l...rgery-csrf
Pierrick thank you for your reply, My problem, if I understand the documentation, is the reverse. I would have to have several different token for each form of my page. They are treated individually with an ajax post .
To be more precise this is my case,, if I submit an ajax forms with the others become invalid (erreur403)
Merci Peirerik de ta réponse. Mon  problème ,  si jai bien compris la documentation,  est  l'inverse.  Il faudrait que  j'ai  plusieurs token  différent  pour chaque formulaire de ma page .  Ils sont traités individuellement avec un  post ajax .
Pour  être  plus précis  voici mon  casConfusedi  je  soumet un des formulaires avec ajax  les  autres deviennent invalides ( erreur403)



PHP Code:
<?php echo form_open_multipart('Element/addElement', array('class' => 'form-horizontal''role' => 'form''id' => 'FrmElement''name' => 'FrmElement')); ?>
<?php 
for($num=0$num<;$num++): ?>
<form action="#" method="post" class="form-horizontal"  id="FrmInsertPhoto<?php echo $num?>" name="FrmInsertPhoto<?php echo $num?>" style="border:none !important" enctype="multipart/form-data">
   <input type="hidden" name="<?=$csrf['name'];?>" value="<?=$csrf['hash'];?>" />
<?php form_close()?>
<?php 
endfor; ?>
<?php 
echo form_close(); ?>
If I submit  frmInsertPhoto0  I can't submit the others  without having a 403..  
for now I excluded the url of the controller
PHP Code:
$config['csrf_exclude_uris'] = array('Ajax_Loader_file/AjaxChgPhotoElement/[0-9]+'); 
Reply




Theme © iAndrew 2016 - Forum software by © MyBB