Timeline for Menu Callback and CSRF
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 22, 2015 at 14:10 | answer | added | JaceRider | timeline score: 0 | |
| Oct 9, 2015 at 16:29 | answer | added | Wim Leers | timeline score: 4 | |
| Sep 28, 2015 at 15:17 | comment | added | greggles | BTW, CSRF tokens are used in both menu callbacks and forms to protect against CSRF. You have to explicitly add them to menu paths that you want to protect, but they are added to all forms by default. | |
| Sep 28, 2015 at 15:16 | comment | added | greggles | Thanks, I wasn't sure, but it seemed like a possibility. | |
| Sep 26, 2015 at 21:48 | comment | added | Trey | @greggles mymodule.test it expects a route in D8 , not a path | |
| Sep 26, 2015 at 21:48 | comment | added | Trey | @IvanJaros CSRF tokens are used also in the menu router to protect menu callbacks that are not form submissions | |
| Sep 26, 2015 at 14:14 | answer | added | Berdir | timeline score: 2 | |
| Sep 26, 2015 at 13:20 | comment | added | greggles | Are you using mymodule.test as the argument to url or are you using mymodule-test? | |
| Sep 26, 2015 at 11:46 | history | edited | avpaderno♦ | CC BY-SA 3.0 |
removed tags from title
|
| Sep 26, 2015 at 7:49 | comment | added | user21641 | CSRF tokens are used only in forms, to my (very limited knowledge in this subject) where it makes sense. So if you need CSRF token for some of your pages then you also need to process/validate the value on your own. Either during page request via EventSubscriber or in block/part of the page where you need validation. | |
| Sep 25, 2015 at 21:30 | history | asked | Trey | CC BY-SA 3.0 |