5

I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page."

Upon debugging, I found that CSRF validation fails when CC avenue posts response on return URL. While I also tried solution mentioned on the post : Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint, still the error persists. Possible reason could be that interface mentioned in above post is not being used rather it gets into Magento\Framework\App\Request\CsrfValidator class which implements Magento\Framework\App\Request\ValidatorInterface.

Possible workaround is to override class - Magento\Framework\App\Request\CsrfValidator as follows:

public function validate(
        RequestInterface $request,
        ActionInterface $action
    ): void {
        try {
            $areaCode = $this->appState->getAreaCode();
        } catch (LocalizedException $exception) {
            $areaCode = null;
        }
        if ($request instanceof HttpRequest
            && in_array(
                $areaCode,
                [Area::AREA_FRONTEND, Area::AREA_ADMINHTML],
                true
            )
        ) {
            //Custom code
            if ($request->getRequestUri() == 'custom/uri')
            {
                $valid = true;
            }
            else {
                $valid = $this->validateRequest($request, $action);
            }
            if (!$valid) {
                    throw $this->createException($request, $action);
                }
            }
    }

Question is - how do I override this class? I tried writing dependency injection but did not work!

  • I have also faced the same issue. The solution in the link is working for me. – Sree Feb 7 at 12:38
  • @Sree - For which version of Magento you faced this issue? I am facing it for Magento 2.3.0 – Rizwan Dhuka Feb 8 at 6:32
  • When you say you tried writing dependency injection, do you mean that you tried setting a Preference in di.xml? If not, that'd be my first thing to try – zack6849 Feb 11 at 13:53
  • @zack6849 - Yes I tried preference in di.xml with no luck. – Rizwan Dhuka Feb 13 at 5:07
2
+50

You can add a formKey to your request.

Magento checks in the validateRequest function at Magento\Framework\App\Request\CsrfValidator if the request is intance of CsrfAwareActionInterface, not a post request, ajax or has a valide formKey:

private function validateRequest(
        HttpRequest $request,
        ActionInterface $action
    ): bool {
        $valid = null;
        if ($action instanceof CsrfAwareActionInterface) {
            $valid = $action->validateForCsrf($request);
        }
        if ($valid === null) {
            $valid = !$request->isPost()
                || $request->isAjax()
                || $this->formKeyValidator->validate($request);
        }

        return $valid;
    }

You can inject Magento\Framework\Data\Form\FormKey and add to your request, something like this:

 $requestUrl .= '?form_key=' . $this->formKey->getFormKey();
  • It did the trick.. Many thanks! – Rizwan Dhuka Feb 13 at 6:35
  • you are welcome – gemig_hol Feb 13 at 10:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.