CakePHP blackholing search after using back button

Question

I'm having a problem with SecurityComponent in my CakePHP 2.4 app:

I have a form which is hooked up to the CakeDC Search plugin to filter the results on my index action. The problem is that SecurityComponent does exactly what it's supposed to do, and protects against a form being submitted twice- if a user searches, goes back, and searches again, it throws a CSRF error because the token has already been used.

I've tried one solution for this, which involves disabling SecurityComponent on my index action with this code in beforeFilter:

if($this->request->action == 'index'){
     $this->Components->disable('Security');
  }

This protects users against a blackhole error, however it also means that my delete links no longer work because the delete action expects a token from a page with Security enabled- and for obvious reasons I don't want to disable Security on delete.

How can I avoid blackholes when users search after using the back button, while still keeping SecurityComponent running so my delete links work?

floriank floriank · Accepted Answer · 2014-08-03T22:19:13

Read the documentation about CSRF.

SecurityComponent::$csrfUseOnce Controls whether or not CSRF tokens are single use. Set to false to not generate new tokens on each request. One token will be reused until it expires. This reduces the chances of users getting invalid requests because of token consumption. It has the side effect of making CSRF less secure, as tokens are reusable.

Re-using the token should solve the problem.

CakePHP blackholing search after using back button

1 Answers