Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Disable CSRF validation for individual actions in Yii2

Tags:

csrf

yii2

Is there a way to disable CSRF validation for some actions of the controller keeping it enabled for the other ones?

In my case I have several configurable Action classes, that are intended to be injected into controllers. I can't pass csrf validation token into the AJAX request because the thing I'm working with is external (made not by me) WYSIWYG plugin at the frontend. Yes, I can still disable csrf validation of the whole controller using these actions, but it may be insecure.

like image 602
coderlex Avatar asked Feb 15 '15 14:02

coderlex


1 Answers

For the specific controller / actions you can disable CSRF validation like so:

use Yii;  ...  Yii::$app->controller->enableCsrfValidation = false; 

Or inside a controller:

$this->enableCsrfValidation = false; 

Take a look at $enableCsrfValidation property of yii\web\Controller.

Update:

Here is some specification.

If you want to disable CSRF validation for individual action(s) you need to do it in beforeAction event handler because CSRF token is checked before action runs (in beforeAction of yii\web\Controller).

/**  * @inheritdoc  */ public function beforeAction($action) {                 if ($action->id == 'my-method') {         $this->enableCsrfValidation = false;     }      return parent::beforeAction($action); } 

Official docs:

  • beforeAction()
like image 148
arogachev Avatar answered Oct 04 '22 14:10

arogachev