93.208.103.149: Die Seite wurde neu angelegt: „Use CSRF in your own forms Problem If you do not wish to create forms via the ProcessWire API, but still aiming to use PW's form features, you can use its CRS…“

2019-02-09T16:34:17Z

Die Seite wurde neu angelegt: „Use CSRF in your own forms Problem If you do not wish to create forms via the ProcessWire API, but still aiming to use PW's form features, you can use its CRS…“

Neue Seite

Use CSRF in your own forms
Problem

If you do not wish to create forms via the ProcessWire API, but still aiming to use PW's form features, you can use its CRSF (Cross-Site Request Forgery) preventing features like so:

Solution
https://processwire-recipes.com/recipes/use-csrf-in-your-own-forms/

First you need to create a token and a token name, you do that as following:

$tokenName = $this->session->CSRF->getTokenName();
$tokenValue = $this->session->CSRF->getTokenValue();

Now what you want to do is create a hidden input field like this:

$html .= '<input type="hidden" id="_post_token" name="' . $tokenName . '" value="' . $tokenValue . '"/>';

Now this will generate something that will look like this:

<input type="hidden" id="_post_token" name="TOKEN1470842875" value="fe8ce9c1b9e6b9e361830df3525c49317a35332fbf626aa8793777a3b705824a">

You are done on the form side.

You can now go to the part where you are receiving the post. Then use:

$session->CSRF->validate();

This will return true (1) on a valid request and an exception on a bad request. You can test this out to open up your Firebug/Chrome debug console and change the value of the textbox to something else.

Basicly what this does is set a session variable with a name (getTokenName) and gives it a hashed value. If a request has a token in it it has to have the same value or it is not send from the correct form.

ProcessWire - Formulare mit CSRF Schutz - Versionsgeschichte

93.208.103.149: Die Seite wurde neu angelegt: „Use CSRF in your own forms Problem If you do not wish to create forms via the ProcessWire API, but still aiming to use PW's form features, you can use its CRS…“