Disable CSRF validation for individual actions in Yii2

by

For the specific controller / actions you can disable CSRF validation like so:

use Yii;

...

Yii::$app->controller->enableCsrfValidation = false;

Or inside a controller:

$this->enableCsrfValidation = false;

Take a look at $enableCsrfValidation property of yii\web\Controller.

Update:

Here is some specification.

If you want to disable CSRF validation for individual action(s) you need to do it in beforeAction event handler because CSRF token is checked before action runs (in beforeAction of yii\web\Controller).

/**
 * @inheritdoc
 */
public function beforeAction($action)
{            
    if ($action->id == 'my-method') {
        $this->enableCsrfValidation = false;
    }

    return parent::beforeAction($action);
}

Official docs:

More Related Contents:

  1. What is a CSRF token? What is its importance and how does it work?
  2. Django CSRF check failing with an Ajax POST request
  3. CSRF, XSS and SQL Injection attack prevention in JSF
  4. WARNING: Can’t verify CSRF token authenticity rails
  5. include antiforgerytoken in ajax post ASP.NET MVC
  6. jQuery Ajax calls and the Html.AntiForgeryToken()
  7. Where to store JWT in browser? How to protect against CSRF?
  8. Why is it common to put CSRF prevention tokens in cookies?
  9. Do login forms need tokens against CSRF attacks?
  10. CSRF (Cross-site request forgery) attack example and prevention in PHP
  11. codeigniter CSRF error: “The action you have requested is not allowed.”
  12. rails – “WARNING: Can’t verify CSRF token authenticity” for json devise requests
  13. Enable clean URL in Yii2
  14. Spring Security 3.2 CSRF support for multipart requests
  15. Spring CSRF token does not work, when the request to be sent is a multipart request
  16. Laravel catch TokenMismatchException
  17. Forbidden (403) CSRF verification failed. Request aborted. Even using the {% csrf_token %}
  18. New CSRF token per request or NOT?
  19. CSRF protection: do we have to generate a token for every form?
  20. Same-Site flag for session cookie in Spring Security
  21. Are JSON web services vulnerable to CSRF attacks?
  22. Difference between CSRF and X-CSRF-Token
  23. CSRF state token does not match one provided FB PHP SDK 3.1.1 Oauth 2.0
  24. LIMIT is not working in ActiveDataProvider
  25. Codeigniter CSRF valid for only one time ajax request
  26. Log the actual SQL query using ActiveRecord with Yii2?
  27. How do I solve an AntiForgeryToken exception that occurs after an iisreset in my ASP.Net MVC app?
  28. CSRF Token missing or incorrect
  29. Yii2 require all Controller and Action to login
  30. What does Cookie CsrfTokenRepository.withHttpOnlyFalse () do and when to use it?

Leave a Comment