cakephp 2.6 security request black-holed from another view

1
votes

i red a lot about black holed requests in cakephp but i didn't found a working solution for my problem.

In my application i am using the login form in several places, so i created a reusable element. like:

echo $this->Form->create('User', array('class' => 'form-horizontal', 'role' => 'form', 'url' => array('controller' => 'users', 'action' => 'login')));
echo $this->Form->input('email', array('label' => false, 'class' => 'form-control'));
echo $this->Form->input('password', array('label' => false, 'class' => 'form-control'));
echo $this->Form->end();

(Note: url to controller and action in form)

If i click the form's send button in foo.com/users/login i got redirected to users/view in success or back to users/login in failure. After that i press the browsers page return button to get back to the form and again click the send button all works fine and the login is checked again. But if i do the same in for example foo.com/pages/home i get a request black-holed exception in the second continues (the first works fine).

If i deactivate the security component all works fine, but this is not what i want.

How can i prevent this?

I also recognized that the securtiy component is by default not available? Is this true?

Thanks for helping.

1
phpsecuritycakephpcakephp-2.0
security component prevents user from re hitting the form , i guess you are re hitting the form in your test. - Abhishek
but how can i handle this? it is not ver user-friendly. Can i automatically refresh the page if the user hit the page back button so a new token is generated? What is the recommended way to handle it? - q0re
you can re validate a page if user clicks back button - Abhishek
can you show me a example or link to cakephp book? - q0re
$this->response->disableCache(); did it! thank you so much. In my case i have to put it into PagesController's display action. Post your answer and i will accept it. - q0re

1 Answers

2
votes

Security component prevents user from re hitting the form. When user press back button you can re-validate a page using

$this->response->disableCache();