4
votes
Accepted
Generating URL with CSRF token
Well, I found a solution, however, I'd be amazed if there isn't a better way to do it, and in fact I'm pretty sure it's bypassing the placeholder API, so it's likely the wrong way to do it. But until ...
- 18k
4
votes
Accepted
Is the X-csrf-token only available for authenticated users?
Drupal still doesn't use CSRF tokens for anonymous users. The CSRF token is also checked only when a session is available for the currently logged-in user, and only when the request method declared ...
- 97.9k
3
votes
refresh form_token with refresh page
As the definition of CSRF says
A CSRF token is a secure random token (e.g., synchronizer token or
challenge token) that is used to prevent CSRF attacks. The token needs
to be unique per user session ...
- 22.2k
2
votes
Implement anti-CSRF tokens into all requests to add protection from cross-site request forgery attacks
Drupal already has CSRF protection for authenticated users.
One day core may add support to protect anonymous users as well.
In the meantime, you could look at the anonymous token module, or force all ...
- 29.4k
2
votes
Accepted
How to get the JWT token via webservice
You may try to use Get JWT on Login module that I have created for the same purpose.
- 361
2
votes
Request header field X-CSRF-Token is not allowed by Access-Control-Allow-Headers in preflight response for Drupal 7 REST API
Have a look at cors module
You'll be able to add necessary Access-Control-Allow-Headers
Otherwise, you can do this by changing your apache (or nginx or whatever) conf.
In drupal 8, you define this ...
- 1,343
2
votes
How to fix "Clickjacking"?
You could use this module which is available for Drupal 6 to make your site more secure and tackle Clickjacking especially.
Clickjacking can also be tackled on the webserver level directly, do some ...
- 1,250
2
votes
Generating URL with CSRF token
Based on the code of Jaypan but with additional parameter (node id):
routing.yml:
entity.node.publish:
path: '/node/{node}/toggleStatus'
defaults:
_controller: 'Drupal\publishcontent\...
- 21
2
votes
refresh form_token with refresh page
Drupal's anti-CSRF token works by combining information that is secret to the site, the action, and the individual user into a hashed value sent in the HTML of the page.
From https://www.drupal.org/...
- 6,344
2
votes
Accepted
Fix for "'csrf_token' URL query argument is invalid" error during logout
To get the right csrf_token you should first request /session/token this route coming from system.routing.yml so in your controller action add those two things:
Get the system csrf_token from /...
- 7,298
1
vote
Fix for "'csrf_token' URL query argument is invalid" error during logout
You can use POST method on /user/logout without params and token, the cookie will be deleted so the user will be logged out, but in the server-side Drupal will not destroy the session, so you'll end ...
- 39
Only top scored, non community-wiki answers of a minimum length are eligible