Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [csrf]

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts

0
votes
0answers
107 views

How can I validate the form_build_id in Drupal 8 form submissions?

Drupal will accept a form submission without a valid form_build_id which opens it up to XSS attacks. The form gets submitted even If I delete the hidden form_build_id input element. I can submit the ...
0
votes
0answers
264 views

How to get the JWT token via webservice

After enabling the JWT module. and following Using JSON Web Tokens (JWT) to Authenticate Requests to REST Resources in Drupal 8 on how to use it, it is working. I know I can access the user JWT ...
0
votes
1answer
2k views

Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API

I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error: Request header field X-CSRF-Token is not ...
1
vote
1answer
530 views

How to handle session for anonymous users for CSRF tokens?

I need to provide list of CSRF tokens in drupalSettings for every anonymous user so JS can make safe requests to api endpoints. The CSRF service mentions the need for session to exist for the seed ...
0
votes
1answer
346 views

Unauthorized : CSRF validation failed issue for Logged in user

I need to hide button for Logged in user. For that I have written the following code in dashboard.js file. Code working fine for anonymous user. But not working for Logged in user. $(document).on("...
1
vote
0answers
282 views

“CSRF validation failed” using “Session Token authentication only”

Having problem in CSRF validation when using Session Token authentication only using services_session_token_auth 7.x-1.x-dev module. already set the token but it keeps throwing CSRF validation failed....
-1
votes
1answer
134 views

How to fix “Clickjacking”?

I have got this vulnerability "#150124 Clickjacking - Framable Page". Can anyone suggest how to fix this vulnerability for a Drupal 6 site?
3
votes
2answers
1k views

Generating URL with CSRF token

I have a route that requires a CSRF token: mp.ajax.authorized: path: /mp/ajax/authorized defaults: _controller: 'Drupal\mp\Controller\AjaxController::authorizedCallback' requirements: ...
0
votes
1answer
667 views

Login Users sessions persistence using Services and Rest Server modules

I'm having a heck of a time creating drupal services from angular hitting the rest server. I created a rest end point for all my authentication needs, configured in the Service module. When I use ...
0
votes
2answers
386 views

Get user ID from CSRF token

Is there any way how can i programmatically get user ID from CSRF token? I´m using web service and need to update user data according to user token. Thanks
0
votes
1answer
399 views

CSRF token not working (access denied)

I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error. Removing CSRF token line from ...
2
votes
1answer
349 views

Services CSRF Token request security

A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
2
votes
3answers
525 views

Menu Callback and CSRF

How can I get a link with the correct csrf token for an internal path? Here is what I have: in mymodule.routing.yml mymodule.test: path: '/mymodule-test' defaults: _content: 'Drupal\mymodule\...
2
votes
1answer
173 views

My site is hacked [duplicate]

It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code: $sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
0
votes
2answers
3k views

Services 3 Session authentication CSRF Validation with Persistent Log in

I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated ...
1
vote
2answers
576 views

csrfToken: reget without logout user

I have a site where I use AngularJS to connect to Services module paths. Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to ...
2
votes
1answer
6k views

Problems with Services and CSRF token

I've been trying to create a user via webservice without doing any custom coding or curl. This post got me 75% there: How to create test_endpoint? I finally got it working, but only by passing in my ...
2
votes
1answer
2k views

Creating a node with PHP cURL client returns 401 error - X-CSRF token always empty [closed]

A recent update to Services and Drupal requires a csrf token, and it broke the PHP cURL client samples. I am trying the sample code for Services to: Create a node here https://drupal.org/node/...