CsrfToken mismatch with proper token?

FinlayDaG33k · February 13, 2020, 10:14pm

Hii there,

I’m trying to get my app to submit something with XHR to an API my app exposes through a plugin.
Everything shows up fine in my request but I still get a token mismatch.
I’ve looked at a form on my website as well to make sure the token lines up with what said form would send and it does.

However, somehow, the form itself can send it just fine but my XHR gets a CsrfToken mismatch…
I can’t tell it to “not use csrf” here either because it just ignores that (and I don’t want to bother the user of this plugin with manually adding it to the whitelist in his/her project).

Graziel · February 14, 2020, 9:00am

how are you sending XHR request? show code, i dont see _csrfToken in POST Data in your screenshot

FinlayDaG33k · February 14, 2020, 11:37am

It’s in the Cookie section.
(highlighted in the first screenshot).

Graziel · February 14, 2020, 11:56am

you need to send both cookie and field in post data (or header)

github.com

cakephp/cakephp/blob/bd8648bd6ff47ba47d00c93bd91d863885eb1960/src/Http/Middleware/CsrfProtectionMiddleware.php#L231


    {
        $cookies = $request->getCookieParams();
        $cookie = Hash::get($cookies, $this->_config['cookieName']);
        $post = Hash::get($request->getParsedBody(), $this->_config['field']);
        $header = $request->getHeaderLine('X-CSRF-Token');


        if (!$cookie) {
            throw new InvalidCsrfTokenException(__d('cake', 'Missing CSRF token cookie'));
        }


        if (!Security::constantEquals($post, $cookie) && !Security::constantEquals($header, $cookie)) {
            throw new InvalidCsrfTokenException(__d('cake', 'CSRF token mismatch.'));
        }
    }
}

FinlayDaG33k · February 14, 2020, 12:19pm

Oh, alright, I didn’t know that.
Thanks

UPDATE:
Seems to have worked
Now getting a “Missing Controller” error, which is more obvious to fix

Topic		Replies	Views
"CSRF token mismatch" (Cake 3.7.9)	0	885	September 23, 2019
Cakephp 3.8 CSRF token mismatch Need Help release	16	3847	March 20, 2020
Keep getting the error "CSRF token mismatch" Need Help	4	16321	August 17, 2018
CSRF token mismatch While creating REST API Need Help	1	2431	September 15, 2018
CSRF token mismatch in cakephp3.6.13	11	4336	June 5, 2019

CsrfToken mismatch with proper token?

Releases

Documentation

Community

CsrfToken mismatch with proper token?

Related Topics

Releases

Documentation

Community