I am geocoding an address supplied by an anon user on the registration page through ajax and then displaying the point on a map for them. I don't want to have this geocoding permission open to anon users though and just want to make an exception for it in my ajax function. I remember seeing something like this on my past Drupal travels but can't find it for the life of me now. Can someone point me in the right direction?

1 Answer 1


What you want is not possible. Drupal does its best to prevent cross site request forgery, but same site request forgery is not even an established term.

Any candidate for a solution can be circumvented by a script that automates downloading and parsing the registration form, creating the appropriate HTTP request for the AJAX call and sending it to the server.

  • I guess that's true, best I can do is check that the request is coming from someone with a session that's been open for more than a few seconds. Since it's a multipage registration it will take an actual user some time to get to that point.
    – Chris
    Commented Mar 15, 2012 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.