# How should I do CSRF protection in cakephp 2.9?

**URL:** <https://discourse.cakephp.org/t/how-should-i-do-csrf-protection-in-cakephp-2-9/2613>\
**Category:** Uncategorized\
**Created:** [May 24, 2017, 4:05am UTC](https://discourse.cakephp.org/t/how-should-i-do-csrf-protection-in-cakephp-2-9/2613 "2017-05-24T04:05:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![developers](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@developers](https://discourse.cakephp.org/u/developers)\
**Post date:** [May 24, 2017, 4:05am UTC](https://discourse.cakephp.org/t/how-should-i-do-csrf-protection-in-cakephp-2-9/2613/1 "2017-05-24T04:05:54Z")

</div>

I am implementing CSRF protection in my cakephp project. I have read official cakephp 2 cookbook and I did as explained in that book. But, now I am getting the “auth error”, "The request has been black-holed.  
Error:Request URL: /users/changepassword."  
every time the user change password form is submitted.

I have included the security component and also added the $this-\>Security-\>csrfExpires = ‘+1 hour’; in the before filter function. Is there any steps missed in my implementation ?

---

<div class="post-metadata">

**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://discourse.cakephp.org/u/Denis)\
**Post date:** [October 20, 2017, 12:49pm UTC](https://discourse.cakephp.org/t/how-should-i-do-csrf-protection-in-cakephp-2-9/2613/2 "2017-10-20T12:49:30Z")

</div>

hello

have you changed the hidden value with javascript ?