【发布时间】：2017-03-14 17:57:26
【问题描述】：
我正在使用 Codeigniter 3.1.3 并在配置文件中启用了 CSRF 保护。不知何故，如果表单通过验证，我总是从 ajax $.post 得到 500（内部服务器错误）。如果验证失败，我不会收到该错误。有什么想法吗？
这里是 codeigniter 配置文件中的 csrf 设置：
$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'csrf_token_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = 7200;
$config['csrf_regenerate'] = TRUE;
这是我在 login.php 视图中的登录表单：
<form id="login_form" class="col-12 col-md-8 mx-auto" method="post">
<div class="alert" id="login-alert" role="alert"></div>
<div class="form-group input-group">
<span class="input-group-addon" id="basic-addon1">Username</span>
<input type="text" class="form-control" id="username" name="username" />
</div>
<div class="form-group input-group">
<span class="input-group-addon" id="basic-addon2">Password</span>
<input type="password" class="form-control" id="pwd" name="pwd" />
</div>
<div class="text-center">
<button type="button" id="login_btn" class="btn btn-primary">LOGIN</button>
</div>
</form>
我正在使用 AJAX $.post 提交表单
$("#login_btn").click(function(){
var data = $("#login_form").serialize();
var csrf_name = "<?=$this->security->get_csrf_token_name()?>";
//get_cookie is a function that I defined to retrieve the cookie
var csrf_cookie = get_cookie("csrf_cookie_name");
$.post('index.php/sentinel/verify_user',data+"&"+csrf_name+"="+csrf_cookie,function(data){
if(data && data !== '')
{
data = data.replace(/(<p>)/g,'').replace(/(<\/p>)/g,'<br>');
$("#login-alert").prop('class','alert alert-danger').html(data);
}
else
{
//success
//redirect to the main page
}
});
});
function get_cookie( check_name ) {
var a_all_cookies = document.cookie.split( ';' );
var a_temp_cookie = '';
var cookie_name = '';
var cookie_value = '';
var b_cookie_found = false; // set boolean t/f default f
for ( i = 0; i < a_all_cookies.length; i++ )
{
// now we'll split apart each name=value pair
a_temp_cookie = a_all_cookies[i].split( '=' );
// and trim left/right whitespace while we're at it
cookie_name = a_temp_cookie[0].replace(/^\s+|\s+$/g, '');
// if the extracted name matches passed check_name
if ( cookie_name == check_name )
{
b_cookie_found = true;
// we need to handle case where cookie has no value but exists (no = sign, that is):
if ( a_temp_cookie.length > 1 )
{
cookie_value = unescape( a_temp_cookie[1].replace(/^\s+|\s+$/g, '') );
}
// note that in cases where cookie is initialized but no value, null is returned
return cookie_value;
break;
}
a_temp_cookie = null;
cookie_name = '';
}
if ( !b_cookie_found )
{
return null;
}
}
这是我的控制器：
public function verify_user(){
$this->form_validation->set_rules('username', 'Username', 'required|alpha');
$this->form_validation->set_rules('pwd', 'Password', 'required|callback_alpha_numeric_dots');
$this->form_validation->set_message('alpha_numeric_dots','Invalid Password.');
if ($this->form_validation->run() == FALSE)
{
echo validation_errors();
}
else
{
$this->form_validation->set_rules('pwd','Password','callback_login_check');
if ($this->form_validation->run() == FALSE)
{
echo validation_errors();
}
else
{
echo '';
}
}
}
public function login_check(){
$data = $this->security->xss_clean($this->input->post());
$rep_info= $this->sentinel_model->user_verify($data);
if($rep_info === FALSE)
{
$this->form_validation->set_message('login_check', 'Incorrect Username or Password');
return FALSE;
}
else
{
//set session data here
$newdata = array(
'id' =>$this->encryption->encrypt($rep_info['user_id']),
'name' => $rep_info['user_name'],
'email' => $rep_info['user_email'],
'logged_in' => TRUE
);
$this->session->set_userdata($newdata);
return TRUE;
}
}
public function alpha_numeric_dots($str)
{
return (bool) preg_match('/^[A-Z0-9.]+$/i', $str);
}
我还想在用户成功登录后将用户重定向到另一个视图而不更改 url。最好的方法是什么？
【问题讨论】：
-
显示你的函数
get_cookie -
添加函数 get_cookie
标签： jquery ajax codeigniter-3 internal-server-error csrf-protection