How to handle CSRF Validation in Yii2 Framework?

Question

I'm having problem with CSRF Validation in yii2. The validation works fine with the default form generated by the gii but when I edit the form with html tags then the form submission throws a bad request error. I have disabled csrf validation to hide the error but I want to use this for the security of the application and data validation.

Is there any way of solving this error or is there a way of configuring it to work correctly in this scenario?

Without seeing the code it's hard to assume what can cause this problem. Please add form changes that broke CSRF validation. — arogachev, Feb 12 '15 at 09:17
Please update your question instead of posting it as comment, — arogachev, Feb 12 '15 at 15:50

score 51 · Answer 1 · edited Feb 12 '15 at 15:01

51

I guess, your html form doesn't have hidden _csrf field, which is automatically generated by standard Yii2 widgets.

So the minimum code of your custom form might be like this:

<form method="post">
    <input type="hidden" name="<?= Yii::$app->request->csrfParam; ?>" value="<?= Yii::$app->request->csrfToken; ?>" />
    <button type="submit"> Save </button>
</form>

edited Feb 12 '15 at 15:01

arogachev

33,150
7
114
117

answered Feb 12 '15 at 14:02

Pavel Bariev

2,546
1
18
21

I've only changed the form input element with custom html element and my form element include the csrf value with name that is generated by the gii. i don't know what's happening. – msucil Feb 12 '15 at 15:47
I have hidden _csrf param in my Yii2 form and autogenerated token as its value. But anyway my app.log is full of BadRequestHttpException entries, even though the form data is stored normally. What am I doing wrong and how to fix it? – mogilka Aug 07 '17 at 09:56

score 6 · Answer 2 · answered Nov 29 '18 at 10:28

6

Try this

<?=yii\helpers\Html::hiddenInput(Yii::$app->request->csrfParam, Yii::$app->request->csrfToken)?>

answered Nov 29 '18 at 10:28

Alex S

719
6
8

How to handle CSRF Validation in Yii2 Framework?

2 Answers2

Linked