Implementing CSRF into OpenID iframe

Question

I've implemented Janrain Open ID on my Codeigniter 2.0 website. It was working great until I enabled CSRF protection in my codeigniter config file.

I read up on it and it seems that in all my forms on my website I should include a hidden form element containing a token, which is then verified against a cookie token after the post is read from the receiving page.

This is all fine and dandy, but where I'm a bit stuck is when I try to log into my site now using OpenID (of which the login form comes from an iframe that is hosted on janrain.com) I cannot include any sort of hidden post values because I have no control over what the form looks like, and can only supply a return url so that janrain knows what page to return me to.

How can I get my CSRF token to submit with the form if the form is in an iframe which I don't control?

Answer 1

You can also just add this to the end of your token URL:

?ci_csrf_token='.$this->security->get_csrf_hash()

So let's say you were using an embeded iframe for Janrain, the complete code would end up looking like this with:

<iframe src="https://MYACCOUNT.rpxnow.com/openid/embed?token_url=<?PHP echo rawurlencode($token_url).'?ci_csrf_token='.$this->security->get_csrf_hash(); ?>" scrolling="no" frameborder="0" seamless="seamless" style="width:400px; height:240px;"></iframe>

I have this working great on my codeigniter, and you do not need to disable your CSRF security :)