1

I have a website made with CakePHP 3.6 that seemed to work fine on my computer (using WAMP, PHP 5.6.31, Apache 2.4.27) but has a different behaviour when put in a production server (Ubuntu 14.04, PHP 5.6.37, Apache 2.4.7).

There is this one POST request that generates the following error ONLY on the production server :

'_Token' was not found in request data.

Cake\Controller\Exception\AuthSecurityException

I have the security component enabled, and I don't want to disable it. All form fields are created with the FormHelper. The fields are not modified with Javascript.

The error does not always happen and mostly depend on the content that is entered in the forms by the user. I could not identify what kind of content would generate this error. The data sent is a groupe of strings that might contain anything. But I don't see how the content is relevant for this error.

Here is a sample of the code that generates the form

<?php

    echo '<div class="custom-card">';
    echo $this->Form->create($keyword);
    echo '<table class="table table-striped table-bordered">';

    // Create Table Headers with languages name
    $tableHeaders = ["Mot clé"];
    for ($i = 0; $i < count($languagesEnabled); $i++)
    {
        array_push($tableHeaders, "{$languagesEnabled[$i]->name} (version {$languagesEnabled[$i]->version})");
    }
    array_push($tableHeaders, "");
    echo '<thead>';
    echo $this->Html->tableHeaders($tableHeaders);
    echo '</thead>';

    //Fill Table Cells with keywords and sentences
    for ($i = 0; $i < count($keywords); $i++)
    {
        $keywordName = $this->Form->text("keywords.$i.name", ["value" => $keywords[$i]->name, 'class' => 'form-control']);
        $keywordId = $this->Form->hidden("keywords.$i.id", ["value" => $keywords[$i]->id]);

        $tableCells = [$keywordName . " " . $keywordId];
        $tableCells = array_pad($tableCells, count($languages) - 1, "");
        for ($j = 0; $j < count($languagesEnabled); $j++)
        {
            $sentenceLanguageId = $this->Form->hidden("keywords.$i.sentences.$j.language_id", ["value" => $languagesEnabled[$j]->id]);
            $sentenceKeywordId = $this->Form->hidden("keywords.$i.sentences.$j.keyword_id", ["value" => $keywords[$i]->id]);
            $sentenceArray = ["value" => findSentenceValueInArray($keywords[$i]->sentences, $languagesEnabled[$j]->id)];
            $sentenceValue = $this->Form->textarea("keywords.$i.sentences.$j.sentence", [
                'value' => $sentenceArray,
                'class' => 'form-control',
                'id' => "area-$i-$j",
                'onfocus' => "autosize(document.getElementById('area-$i-$j'))"
                ]);
            $tableCells[$j + 1] = $sentenceValue . $sentenceLanguageId . $sentenceKeywordId;
        }
        $tableCells[count($languagesEnabled) + 1] = $this->Html->link('Supprimer',
            ['controller' => 'Keywords', 'action' => 'remove', $keywords[$i]->id],
            ['confirm' => 'Êtes vous sûr de vouloir supprimer la phrase ?']);
        echo $this->Html->tableCells($tableCells);
    }
    echo "</table>";
    echo $this->Form->submit('Valider', ['class'=>'btn btn-primary']);
    echo $this->Form->end();
    echo '</div>';
?>
Mythique
  • 21
  • 5
  • You have 2 forms in this code. Which one gives the error? – Felippe Duarte Aug 09 '18 at 20:46
  • Good catch @felippe, I removed the form that was not related to the error. – Mythique Aug 09 '18 at 20:51
  • Maybe you have some cached information. Did you tried clearing cached data? – Felippe Duarte Aug 09 '18 at 20:59
  • I have seen this when the size of the data submitted through the form exceeded what PHP was configured to allow: the _Token is right at the end, so if the data is truncated, it is the first to get lost. Happens most commonly to me when people submit very large images, but it's theoretically possible that it could happen with smaller forms too. Unlikely in your case, I think, but not impossible. – Greg Schmidt Aug 10 '18 at 02:23
  • FelippeDuarte I tried on a fresh install without any cached data, the same thing was happening. GregSchmidt I thought it was something like this. Unfortunately my "post_max_size" in the php.ini file is already at a higher value than the data i try to send. – Mythique Aug 10 '18 at 13:42
  • Well @GregSchmidt you were on the right track! I actually had to increase "max_input_vars" instead of "post_max_size". It's now working perfectly. Thanks for your input. – Mythique Aug 14 '18 at 19:18

1 Answers1

0

Thanks to Greg I was able to find what the problem was. As he stated, if you send too much data it can be truncated.

To diagnose the problem I actually displayed the data received by the SecurityComponent. You can access it in vendor\cakephp\cakephp\src\Controller\Component\SecurityComponent.php. In this file there is a function _validToken(Controller $controller). Displaying the content of the $check variable might help (I used the pr() function for this).

I noticed that some data I sent was actually missing. And obviously, as stated by CakePHP, the _Token was also missing.

The only thing I had to do was increase max_input_vars in my php.ini

Mythique
  • 21
  • 5