CakePHP 3 Security component and Form Fields using VueJS

Question

I'm creating an application using Vue.js and CakePHP 3.6.

When POST, security component throws a 400 error because the _Token fields are missing. I don't have problems with CSRF token, just form security validation.

I don't wanna disable the component in the whole application.

I found a non-solution: Expose _buildFieldToken from the Cake\View\Helper\SecureFieldTokenTrait but I think this will avoid the SecurityComponent purpose.

Any help are really welcome and appriciated.

You'll probably get better answers when you show some code so that people can properly comprehend your problem. Where and how do you build the forms? How is exposing _buildFieldToken() solving the problem? And do you actually need to use form tampering protection for these problematic forms? — ndm

delAmux delAmux · Accepted Answer · 2018-07-24T23:31:22

The action in the controller (example: ajaxRequest) that you need access by fetch or axios, could be unlocked, in the controller:

if you have generated the form with the cake helpers, the _CSRFTOKEN is in the form label or hidden input (sorry inspect the Form element in the browser), when you have localized the token, add this in the data of .$post().

ajax request cakephp

public function beforeFilter(Event $event)
{
     //this line is not necessary if you pass the _csrfToken
     $this->getEventManager()->off($this->Csrf);
     $this->Security->setConfig('unlockedActions', ['ajaxRequest']);
}

CakePHP 3 Security component and Form Fields using VueJS

1 Answers