# How diable csrfToken in form

**URL:** <https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331>\
**Category:** Need Help\
**Created:** [April 23, 2022, 5:27am UTC](https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331 "2022-04-23T05:27:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![arbims](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/arbims/32/2378_2.png) [@arbims](https://discourse.cakephp.org/u/arbims)\
**Post date:** [April 23, 2022, 5:27am UTC](https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331/1 "2022-04-23T05:27:04Z")

</div>

Hello everyone

when I create a form with a method get it adds the csrf token

how can I disable this for forms that have the get method

```php
<?= $this->Form->create(null, ['url' => ['controller' => 'Forums', 'action' => 'index'], 'method' => 'GET']) ?>
        <div class="input-group">
          <input type="text" class="form-control" name="query" placeholder="Rechercher un sujet" value="<?= $query ?? '' ?>">
          <div class="input-group-btn">
            <button class="btn btn-default input-search-forum" type="submit">
              <i class="fa fa-search"></i><span class="search-span">Rechercher</span>
            </button>
          </div>
        </div>
        <?= $this->Form->end() ?>

```

---

<div class="post-metadata">

**Author:** ![MarekDM](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@MarekDM](https://discourse.cakephp.org/u/MarekDM)\
**Post date:** [April 23, 2022, 1:53pm UTC](https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331/3 "2022-04-23T13:53:46Z")

</div>

Change from ‘method’ =\> ‘get’ to ‘type’ =\> ‘get’

---

<div class="post-metadata">

**Author:** ![KevinPfeifer](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/kevinpfeifer/32/3365_2.png) [@KevinPfeifer](https://discourse.cakephp.org/u/KevinPfeifer)\
**Post date:** [April 23, 2022, 4:19pm UTC](https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331/4 "2022-04-23T16:19:05Z")

</div>

My guess would be that you want to have a form which is not checked by the CSRF protection feature.

Even though I don’t understand why you would need to have such a thing (because its a safety feature) you can of course achieve what you want via setting a bit more config.

You need to whitelist your action you are calling in the CSRF Middleware. See:  
[https://book.cakephp.org/4/en/security/csrf.html#skipping-csrf-checks-for-specific-actions](https://book.cakephp.org/4/en/security/csrf.html#skipping-csrf-checks-for-specific-actions)

So in your case adjust your middleware method inside your `src/Application.php`

```auto
public function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue
{
    $csrf = new CsrfProtectionMiddleware();

    // Token check will be skipped when callback returns `true`.
    $csrf->skipCheckCallback(function ($request) {
        $controller = $request->getParam('controller');
        $action = $request->getParam('action');
        $plugin = $request->getParam('plugin');
        // Skip token check for API URLs.
        if ($controller === 'Forums' && $action === 'index') {
            return true;
        }
    });
    
    $middlewareQueue
        // Here are your already present ->add() calls which should basically stay the same
        // BUT you have to replace the already present CsrfProtectionMiddleware instance with your new one from above
        ->add($csrf);

    return $middlewareQueue;
}

```

---

<div class="post-metadata">

**Author:** ![jmcd73](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/jmcd73/32/481_2.png) [@jmcd73](https://discourse.cakephp.org/u/jmcd73)\
**Post date:** [May 16, 2022, 2:40am UTC](https://discourse.cakephp.org/t/how-diable-csrftoken-in-form/10331/5 "2022-05-16T02:40:35Z")

</div>

This stopped `/items/edit?_csrfToken=kJxgXjE...snippage...wQ%3D%3D&item_id=75` being appended and now I get what I wanted `/items/edit?item_id=70`

Thanks @MarekDM