Yii2 Unable to verify your data submission in incognito mode

Question

I have separated backend and frontend by using below:

Backend Config/main.php

$config = [
    'id' => 'app-backend',
    'basePath' => dirname(__DIR__),
    'controllerNamespace' => 'backend\controllers',
    'bootstrap' => ['log'],
    'modules' => [],
    'components' => [
        'request' => [
            'csrfParam' => '_csrf-backend',
            'cookieValidationKey' => 'sdsdsdsd-e8Fhoa1PdHzzfB2VTON9Nfh',
            'class' => 'common\components\Request',
            'web'=> '/backend/web',
            'adminUrl' => '/cpanel'
        ],
        'urlManager' => [
            'class' => 'yii\web\UrlManager',
            'enablePrettyUrl' => true,
            'showScriptName' => false,
        ],
        'user' => [
            'identityClass' => 'common\models\AdminUser',
            'enableAutoLogin' => true,
            'identityCookie' => ['name' => '_identity-project-backend', /*'httpOnly' => true*/],
        ],
        'session' => [
            // this is the name of the session cookie used for login on the backend
            'name' => 'project-backend',
            'timeout' => 60*60*24*30,
        ],
    ],
    'params' => $params,
];

Frontend Config/main.php

$config =  [
    'id' => 'app-frontend',
    'basePath' => dirname(__DIR__),
    'bootstrap' => ['log'],
    'controllerNamespace' => 'frontend\controllers',
    'components' => [
        'request' => [
            'csrfParam' => '_csrf-backend',
            'cookieValidationKey' => 'wmWhVSIv-e8Fhoa1PdHzzfB2VTON9Nfh',            
            'class' => 'common\components\Request',
            'web' => '/frontend/web'
        ],
        'urlManager' => [
            'class' => 'yii\web\UrlManager',
            'enablePrettyUrl' => true,
            'showScriptName' => false,
        ],
        'user' => [
            'identityClass' => 'common\models\User',
            'enableAutoLogin' => true,
            'identityCookie' => ['name' => '_identity-project-frontend', /*'httpOnly' => true*/],
        ],
        'session' => [
            // this is the name of the session cookie used for login on the frontend
            'name' => 'project-frontend',
            'timeout' => 60*60*24*30,
        ],
        'log' => [
            'traceLevel' => YII_DEBUG ? 3 : 0,
            'targets' => [
                [
                    'class' => 'yii\log\FileTarget',
                    'levels' => ['error', 'warning'],
                ],
            ],
        ],
        'errorHandler' => [
            'errorAction' => 'site/error',
        ],        
    ],
    'params' => $params,
    //'defaultRoute' => 'site/index'
];

Now it is working perfectly in normal browser mode. But when ever i am trying to login using incognito mode, on first attempt it gives below error:

Unable to verify your data submission

After that, if i reload the page and try to login again, it works normally.

My form is generated using ActiveForm, so CSRF token is available in login page.

So how to solve this problem?

score 0 · Answer 1 · answered Jan 11 '17 at 06:07

0

Yo can specify the validation false in specific controller / actions

include the Yii class

use Yii;

inside the action

Yii::$app->controller->enableCsrfValidation = false;

or inside the controller

$this->enableCsrfValidation = false;

answered Jan 11 '17 at 06:07

Rahman

282
1
10

1

But that decrease the security. I don't want to disable csrf token. – DS9 Jan 11 '17 at 06:54
if you have using activeform – Rahman Jan 11 '17 at 06:55
insert a csrf token hidden input like – Rahman Jan 11 '17 at 06:56
But that CSRF token is already there because i have used ActiveForm. – DS9 Jan 11 '17 at 07:00
if u using ajax submition or normal post – Rahman Jan 11 '17 at 07:02
Add this in the head section of your layout: = Html::csrfMetaTags() ?> – Rahman Jan 11 '17 at 07:03
Normal Post Request. – DS9 Jan 11 '17 at 07:03
Check whether there is hidden input in your form with CSRF token – Rahman Jan 11 '17 at 07:05
Yes, there is meta tag as well as hidden _csrf-backend field. – DS9 Jan 11 '17 at 07:08

Saleem Khan · Answer 2 · 2017-01-11T07:39:17.837

-2

You need to set validation false

Set this code inside the action

 Yii::$app->controller->enableCsrfValidation = false;

Set complete controller validation false

$this->enableCsrfValidation = false;

This will work

edited Jan 11 '17 at 07:39

answered Jan 11 '17 at 05:58

Saleem Khan

150
1
9

Yii2 Unable to verify your data submission in incognito mode

2 Answers2