Questions tagged [csrf]
Cross-site request forgery, also known as a one-click attack or session riding, is a type of malicious exploit of a website.
22
questions
2
votes
1answer
83 views
CSRF token is not varying in Ajax callback while submitting form
I have a form with ajax callback as following , on each submit token is not varying , it remains constant for all submit .
wall.routing.yml
wall.commentform:
path: '/commentform'
defaults:
...
0
votes
0answers
20 views
Different behavior of URL response and service response
I am trying to pass csrf_token or session token without an additional request.
I am able to get token using /session/token endpoint.
I am observing a different behavior here.
The response of routing ...
3
votes
1answer
329 views
Is the X-csrf-token only available for authenticated users?
I am working on a rest api end point. I am noticing that some end points work without X-csrf-token header. Digging into the core revealed the following
// This check only applies if
// 1. the ...
1
vote
2answers
712 views
Fix for "'csrf_token' URL query argument is invalid" error during logout
I am creating a set of API endpoints for a mobile app using Rest. For User authentication, I am using the default API endpoints supplied by Drupal. That would be
/user/logout?_format=json&token=&...
1
vote
1answer
182 views
Invalid CSRF token using flag.link_builder service (Flag module)
I have a REST route that returns a list of user accounts. I have a flag setup called 'following' as you can follow and unfollow other members. In my REST route, I use:
$flag_link = \Drupal::service('...
3
votes
1answer
1k views
How to get the JWT token via webservice
After enabling the JWT module. and following Using JSON Web Tokens (JWT) to Authenticate Requests to REST Resources in Drupal 8 on how to use it, it is working.
I know I can access the user JWT ...
0
votes
1answer
3k views
Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error:
Request header field X-CSRF-Token is not ...
2
votes
1answer
989 views
How to handle session for anonymous users for CSRF tokens?
I need to provide list of CSRF tokens in drupalSettings for every anonymous user so JS can make safe requests to api endpoints.
The CSRF service mentions the need for session to exist for the seed ...
0
votes
1answer
850 views
Unauthorized : CSRF validation failed issue for Logged in user
I need to hide button for Logged in user. For that I have written the following code in dashboard.js file.
Code working fine for anonymous user. But not working for Logged in user.
$(document).on("...
1
vote
0answers
380 views
"CSRF validation failed" using "Session Token authentication only"
Having problem in CSRF validation when using Session Token authentication only using services_session_token_auth 7.x-1.x-dev module.
already set the token but it keeps throwing CSRF validation failed....
-1
votes
1answer
407 views
How to fix "Clickjacking"?
I have got this vulnerability "#150124 Clickjacking - Framable Page". Can anyone suggest how to fix this vulnerability for a Drupal 6 site?
5
votes
2answers
3k views
Generating URL with CSRF token
I have a route that requires a CSRF token:
mp.ajax.authorized:
path: /mp/ajax/authorized
defaults:
_controller: 'Drupal\mp\Controller\AjaxController::authorizedCallback'
requirements:
...
0
votes
1answer
967 views
Login Users sessions persistence using Services and Rest Server modules
I'm having a heck of a time creating drupal services from angular hitting the rest server. I created a rest end point for all my authentication needs, configured in the Service module. When I use ...
-1
votes
2answers
834 views
Get user ID from CSRF token
Is there any way how can I programmatically get user ID from CSRF token?
I'm using web service and need to update user data according to user token.
0
votes
1answer
551 views
CSRF token not working (access denied)
I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error.
Removing CSRF token line from ...
2
votes
1answer
514 views
Services CSRF Token request security
A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
2
votes
3answers
690 views
Menu Callback and CSRF
How can I get a link with the correct csrf token for an internal path? Here is what I have:
in mymodule.routing.yml
mymodule.test:
path: '/mymodule-test'
defaults:
_content: 'Drupal\mymodule\...
2
votes
1answer
185 views
My site is hacked [duplicate]
It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
0
votes
2answers
3k views
Services 3 Session authentication CSRF Validation with Persistent Log in
I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated ...
1
vote
2answers
657 views
csrfToken: reget without logout user
I have a site where I use AngularJS to connect to Services module paths.
Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to ...
2
votes
1answer
6k views
Problems with Services and CSRF token
I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?
I finally got it working, but only by passing in my ...
2
votes
1answer
2k views
Creating a node with PHP cURL client returns 401 error - X-CSRF token always empty [closed]
A recent update to Services and Drupal requires a csrf token, and it broke the PHP cURL client samples.
I am trying the sample code for Services to:
Create a node here https://drupal.org/node/...
