{"id":2283,"date":"2019-11-11T11:14:43","date_gmt":"2019-11-11T05:44:43","guid":{"rendered":"http:\/\/blog.openwebsolutions.in\/?p=2283"},"modified":"2019-11-11T11:14:43","modified_gmt":"2019-11-11T05:44:43","slug":"follow-steps-csrf-token-protect-ci-framework","status":"publish","type":"post","link":"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/","title":{"rendered":"Follow the Steps to Use CSRF Token to protect CI Framework"},"content":{"rendered":"

Security is always a primary agenda of application development. CSRF (Cross-Site Request Forgery) token is one of a very common security technique we use for malicious attacks.<\/span><\/p>\n

 <\/p>\n

A common PHP Framework like CodeIgnitor also has that feature. From CI v2.0 it has been introduced. We need to follow some steps to use the automated CSRF Token feature in our own CI applications.\u00a0<\/span><\/p>\n

    \n
  1. In the configuration file set $config[\u2018csrf_protection\u2019] to true<\/strong><\/li>\n
  2. Use form_open() to start a form<\/strong><\/li>\n<\/ol>\n

    These two steps will automatically add a hidden field with CSRF token in the form, and when a POST data encountered the cookie automatically validates the Input class.\u00a0<\/span><\/p>\n

    *For more customization to CSRF you may check this lines on the config file<\/span><\/p>\n

    \/*<\/span>\r\n\r\n|--------------------------------------------------------------------------<\/span>\r\n\r\n| Cross Site Request Forgery<\/span>\r\n\r\n|--------------------------------------------------------------------------<\/span>\r\n\r\n| Enables a CSRF cookie token to be set. When set to TRUE, token will be<\/span>\r\n\r\n| checked on a submitted form. If you are accepting user data, it is strongly<\/span>\r\n\r\n| recommended CSRF protection be enabled.<\/span>\r\n\r\n|<\/span>\r\n\r\n| 'csrf_token_name' = The token name<\/span>\r\n\r\n| 'csrf_cookie_name' = The cookie name<\/span>\r\n\r\n| 'csrf_expire' = The number in seconds the token should expire.<\/span>\r\n\r\n| 'csrf_regenerate' = Regenerate token on every submission<\/span>\r\n\r\n| 'csrf_exclude_uris' = Array of URIs which ignore CSRF checks<\/span>\r\n\r\n*\/<\/span>\r\n<\/pre>\n
     <\/p>\n
    Now if we need to post some data using AJAX then we may need to do some tricks as it is not a simple server-side form posting we may not have the CSRF token field value to our request. So we can do that in the following way.<\/span><\/p>\n
    Define CSRF field name and value as meta to your application like<\/span><\/p>\n
    <<\/span>meta<\/span> name<\/span>=<\/span>\"csrfName\"<\/span> content<\/span>=<\/span>\"<\/span><?php<\/span> echo<\/span> $this<\/span>-><\/span>security<\/span>-><\/span>get_csrf_token_name<\/span>(); <\/span>?><\/span>\"<\/span>><\/span>\r\n<<\/span>meta<\/span> name<\/span>=<\/span>\"csrfHash\"<\/span> content<\/span>=<\/span>\"<\/span><?php<\/span> echo<\/span> $this<\/span>-><\/span>security<\/span>-><\/span>get_csrf_hash<\/span>(); <\/span>?><\/span>\"<\/span>><\/span>\r\n<\/pre>\n
    \u00a0<\/span><\/p>\n
    And then in the js file fetch these values and push into the request and then send the request like:<\/span><\/p>\n
    var<\/span> csrfName<\/span> = <\/span>$<\/span>(<\/span>'meta[name=csrfName]'<\/span>).<\/span>attr<\/span>(<\/span>\"content\"<\/span>);<\/span>\r\n\r\nvar<\/span> csrfHash<\/span> = <\/span>$<\/span>(<\/span>'meta[name=csrfHash]'<\/span>).<\/span>attr<\/span>(<\/span>\"content\"<\/span>);<\/span>\r\n\r\najaxCall();<\/span>\r\n\r\nfunction<\/span> ajaxCall<\/span>()<\/span>\r\n\r\n{<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0<\/span>var<\/span> url<\/span> = <\/span>\u2018YOUR_REQUEST_URL\u2019<\/span>;<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0<\/span>var<\/span> formData<\/span> = { <\/span>[csrfName]:<\/span> csrfHash<\/span>, <\/span>postkey:<\/span> postvalue<\/span> }<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0<\/span>$<\/span>.<\/span>ajax<\/span>({<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>url:<\/span> url<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>type:<\/span> 'post'<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>data:<\/span> formData<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>dataType:<\/span> 'json'<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>success<\/span>:<\/span> function<\/span> (<\/span>data<\/span>) {<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>console<\/span>.<\/span>log<\/span>(<\/span>data<\/span>);<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0});<\/span>\r\n\r\n}<\/span>\r\n\r\n<\/pre>\n
    Here we can have a problem. If we have to submit the request again we will get rejection as we have the old CSRF token in our request as the page is in its old state by not getting reloaded. To overcome that we can replace the ajax function with the below:<\/span><\/p>\n
    $<\/span>.<\/span>ajax<\/span>({<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>url:<\/span> url<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>type:<\/span> 'post'<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>data:<\/span> formData<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>dataType:<\/span> 'json'<\/span>,<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>success<\/span>:<\/span> function<\/span> (<\/span>data<\/span>) {<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>console<\/span>.<\/span>log<\/span>(<\/span>data<\/span>);<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>csrfName<\/span> = <\/span>data<\/span>.<\/span>csrfName<\/span>;<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>csrfHash<\/span> = <\/span>data<\/span>.<\/span>csrfHash<\/span>;<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0}<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0});<\/span>\r\n\r\n<\/pre>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0And our server-side code may look like\u00a0<\/span><\/p>\n
    function<\/span> postFun<\/span>()<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0{<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>$reponse<\/span> = <\/span>array<\/span>(<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>'csrfName'<\/span> => <\/span>$this<\/span>-><\/span>security<\/span>-><\/span>get_csrf_token_name<\/span>(),<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>'csrfHash'<\/span> => <\/span>$this<\/span>-><\/span>security<\/span>-><\/span>get_csrf_hash<\/span>()<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0);<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span>echo<\/span> json_encode<\/span>(<\/span>$reponse<\/span>);<\/span>\r\n\r\n\u00a0\u00a0\u00a0\u00a0}<\/span>\r\n\r\n<\/pre>\n
    Or if CSRF Token is not mandatory for your ajax call you may skip CSRF checking for that particular request by specifying it to the config file.<\/span><\/p>\n
    $config<\/span>[<\/span>'csrf_exclude_uris'<\/span>] = <\/span>array<\/span>(<\/span>'YOUR_ROUTE'<\/span>);<\/span>\r\n\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
    Security is always a primary agenda of application development. CSRF (Cross-Site Request Forgery) token is one of a very common security technique we use for malicious attacks.   A common PHP Framework like CodeIgnitor also has that feature. From CI v2.0 it has been introduced. We need to follow some steps to use the automated […]<\/p>\n","protected":false},"author":63,"featured_media":2290,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[78,18],"tags":[249,210,248,79,35],"yoast_head":"\nFollow the Steps to Use CSRF Token to protect CI Framework<\/title>\n<meta name=\"robots\" content=\"index, follow\" \/>\n<meta name=\"googlebot\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta name=\"bingbot\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Follow the Steps to Use CSRF Token to protect CI Framework\" \/>\n<meta property=\"og:description\" content=\"Security is always a primary agenda of application development. CSRF (Cross-Site Request Forgery) token is one of a very common security technique we use for malicious attacks.   A common PHP Framework like CodeIgnitor also has that feature. From CI v2.0 it has been introduced. We need to follow some steps to use the automated […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/\" \/>\n<meta property=\"og:site_name\" content=\"Openweb Solutions Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-11-11T05:44:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/openwebsolutions.in\/blog\/wp-content\/uploads\/2019\/11\/pexels-photo-270348.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"1880\" \/>\n\t<meta property=\"og:image:height\" content=\"1011\" \/>\n<meta name=\"twitter:card\" content=\"summary\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/openwebsolutions.in\/blog\/#website\",\"url\":\"https:\/\/openwebsolutions.in\/blog\/\",\"name\":\"Openweb Solutions Blog\",\"description\":\"Transforming ideas into reality\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"https:\/\/openwebsolutions.in\/blog\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/openwebsolutions.in\/blog\/wp-content\/uploads\/2019\/11\/pexels-photo-270348.jpeg\",\"width\":1880,\"height\":1011,\"caption\":\"CI & CSRF\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/#webpage\",\"url\":\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/\",\"name\":\"Follow the Steps to Use CSRF Token to protect CI Framework\",\"isPartOf\":{\"@id\":\"https:\/\/openwebsolutions.in\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/#primaryimage\"},\"datePublished\":\"2019-11-11T05:44:43+00:00\",\"dateModified\":\"2019-11-11T05:44:43+00:00\",\"author\":{\"@id\":\"https:\/\/openwebsolutions.in\/blog\/#\/schema\/person\/f584a343b2568016931c94b204e992fb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/openwebsolutions.in\/blog\/follow-steps-csrf-token-protect-ci-framework\/\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/openwebsolutions.in\/blog\/#\/schema\/person\/f584a343b2568016931c94b204e992fb\",\"name\":\"Rajarshi Banerjee\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/openwebsolutions.in\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7bf3399ae5b90592781bc24506579145?s=96&r=g\",\"caption\":\"Rajarshi Banerjee\"},\"description\":\"Over 7 years of experience in web development.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/posts\/2283"}],"collection":[{"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/users\/63"}],"replies":[{"embeddable":true,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/comments?post=2283"}],"version-history":[{"count":8,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/posts\/2283\/revisions"}],"predecessor-version":[{"id":2289,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/posts\/2283\/revisions\/2289"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/media\/2290"}],"wp:attachment":[{"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/media?parent=2283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/categories?post=2283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/openwebsolutions.in\/blog\/wp-json\/wp\/v2\/tags?post=2283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}