CSRFProtector PHP 库不会提交任何表单数据答案

【问题标题】：CSRFProtector PHP library won't submit any form dataCSRFProtector PHP 库不会提交任何表单数据
【发布时间】：2019-04-22 21:17:58
【问题描述】：

我正在使用 PHP 的 CSRFProtector 库 (https://github.com/mebjas/CSRF-Protector-PHP)，一旦我打开它，所有表单都会停止提交，并且出现错误：

403 Access Forbidden by CSRFProtector!

我的配置文件包含：

return array(
    "CSRFP_TOKEN" => "ctkn",
    "logDirectory" => "log",
    "failedAuthAction" => array(
        "GET" => 0,
        "POST" => 0),
    "errorRedirectionPage" => "",
    "customErrorMessage" => "",
    "jsPath" => "js/csrfprotector.js",
    "jsUrl" => "ABS PATH TO js/csrfprotector.js",
    "tokenLength" => 10,
    "disabledJavascriptMessage" => "",
     "verifyGetFor" => array()
);

CSRF 的日志文件显示：

{"timestamp":1433842328,"HOST":"MYDOMAIN.COM","REQUEST_URI":"\/add","requestType":"POST",
"query":{"title":"234","date":"08\/06\/2015","submit":""},
"cookie":{"ctkn":"3c8c7dfebc","__insp_uid":"1173752613",
"PHPSESSID":"SESSION_ID","_ok":"3274-991-10-2674","__utma":"98457856.2008088440.1420840286.1431630284.1432025914.10",
"__utmc":"98457856","__utmz":"98457856.1429793890.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)","__insp_wid":"801086210",
"__insp_nv":"false","__insp_ref":"aHR0cHM6Ly93d3cubmF0dXJhbGhyLm5ldC9sb2dpbg==",
"__insp_identity":"33101","__insp_norec_sess":"true","__insp_slim":"1433237660812",
"mp_3a3715a3d0ca553aea5e93832d489346_mixpanel":"{\"distinct_id\": \"14adaecc111146-0576c4449-63161675-232800-14adaecc1122e6\",
\"$initial_referrer\": \"$direct\",\"$initial_referring_domain\": \"$direct\"}",
"_okbk":"cd5=available,cd4=true,vi5=0,vi4=1433789710017,vi3=active,vi2=false,vi1=false,
cd8=chat,cd6=0,cd3=false,cd2=0,cd1=0,","_gat":"1","_ga":"GA1.2.2008088440.1420840286",
"_oklv":"1433842325615,1q2TBnOvCYwsP8Vp452Bb0OMFOHE0QN6","olfsk":"olfsk31493824627250433",
"_okac":"96642aff6954f6ce73ba12dfbb632117","_okla":"1","wcsid":"1q2TBnOvCYwsP8Vp452Bb0OMFOHE0QN6",
"hblid":"BpAXj2n915tZ7ULn452Bb0OMFPI1k134"}}

谁能告诉我为什么会失败？我需要做什么才能允许这个真正的请求但仍然阻止任何非法请求？

【问题讨论】：

您找到解决方案了吗？还是这个问题仍然存在？ :D 我知道现在问已经太晚了

标签： php csrf csrf-protection

【解决方案1】：

对我来说，问题是我在提交论坛之前使用引导确认模式进行确认。当我检查 $_POST 对象时，我发现它不包含 csrf_token。

你可能有同样的问题。

【讨论】：

【解决方案2】：

您在配置文件中更改了 CSRFP_TOKEN，因此您也需要在 js 文件中进行更改.. IE。 CSRFP_TOKEN: 'ctkn'

【讨论】：