CSRF not working properly in codeigniter

1
votes

I am using codeigniter 3.0.6. Currently working on one page website where there is a search functionality. I have enabled the csrf_protection option in the codeigniter's config file, and used form_open() function to create form.

When I press submit button the search functionality works well, but after submit the form when I refresh the page (with any functionality to refresh the page ie. from keybord or browser refresh) then CSRF doesn't work and display the error "The action you have requested is not allowed.".

Note : I am using post method to submit the form & set csrf_regenerate to true.

1
codeigniter
hi dear, if you refresh the page , so data will be removed. - Manish sharma
you need to make sure all your request includes the ci_csrf_token including you each request. - Mittul Chauhan
something like this <input type="hidden" name="<?php echo $this->security->get_csrf_token_name(); ?>" value="<?php echo $this->security->get_csrf_hash(); ?>"> - Mittul Chauhan
when you are refreshing the page are you posting anything using any form ? if so then you need to pass it wherever you are using this kind of feature. let us know if this helps or not. - Mittul Chauhan

1 Answers

1
votes

The problem is with $config['csrf_regenerate'] = TRUE; set it to FALSE instead.

When TRUE every time you POST to the server the CSRF token changes value. The page must be fully reloaded in order for to receive the new token. A back button won't fully reload the page but the browser's refresh/reload button should.