CodeIgniter use CSRF protection only in some pages

Question

What I want to do is to protect some sensitive forms from CSRF attack in codeigniter but not all pages.

To protect from CSRF if I set it in config.php it applies for all pages. is there any way to do that only for some pages by setting in controller?

$config['csrf_protection'] = TRUE;

Answer 1

You can do this by editing the config.php file

 $config['csrf_protection'] = FALSE;

Step 1: create an array of pages that you want to protect

eg. $csrf_pages = array('login','test');

Step2: check if there is any request for the protected page then set it to TRUE;

if (isset($_SERVER["REQUEST_URI"])) {
    foreach ($csrf_pages as $csrf_page){
        if(stripos($_SERVER["REQUEST_URI"],$csrf_page) !== FALSE) {
            $config['csrf_protection'] = TRUE;
            break;
        }
    }

}

Step 3: add this to your views

<input type="hidden" name="<?php echo $this->security->get_csrf_token_name(); ?>" value="<?php echo $this->security->get_csrf_hash();?>" />

Or simply use the form_open() function to add the hidden CSRF token field automatically.

Answer 2

Now the CI3 have this feature, we can exclude the URIs in the config http://www.codeigniter.com/userguide3/libraries/security.html?highlight=csrf#cross-site-request-forgery-csrf

$config['csrf_exclude_uris'] = array('api/person/add');


$config['csrf_exclude_uris'] = array(
    'api/record/[0-9]+',
    'api/title/[a-z]+'
);

Answer 3

For a more safer approach, you should switch on CSRF protection at all times and only exempt some pages you wish in an array in the config.php file.

$config['csrf_protection'] = TRUE;

Then set an array of links you wish to exempt from CSRF protection:

$csrf_off = array(
    "/api",
    "/api/example",
    "/somelink/something/example"
    );

Now turn those array links CSRF protection off.

if (isset($_SERVER["REQUEST_URI"])) {
    if (in_array($_SERVER["REQUEST_URI"],$csrf_off)) {
        $config['csrf_protection'] = FALSE;
    }
}