0

I am trying to bypass the CSRF validation for my Controller. I had seen a few workaround in the below links.

Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint

But I need my Module compatible with both Magento 2.2 and 2.3. So, I had overridden a core file Magento\Framework\App\Request\Http like below

public function isAjax()
{
   if ($this->getRequestUri() == 'custom/url') {
        return true;
   }
    if ($this->isXmlHttpRequest()) {
        return true;
    }
    if ($this->getParam('ajax') || $this->getParam('isAjax')) {
        return true;
    }
    return false;
}

To bypass the validateRequest() function in Magento\Framework\App\Request\CsrfValidator

private function validateRequest(
    HttpRequest $request,
    ActionInterface $action
): bool {
    $valid = null;
    if ($action instanceof CsrfAwareActionInterface) {
        $valid = $action->validateForCsrf($request);
    }
    if ($valid === null) {
        $valid = !$request->isPost()
            || $request->isAjax()
            || $this->formKeyValidator->validate($request);
    }

    return $valid;
}

It was working fine. I want to know does it affect the technical review in the Magento Marketplace in any way (or) is there any other better way. Thanks in advance.

  • The first step is getting it passing the code quality checks. Are you using this? github.com/magento/magento-coding-standard – Dominic Xigen Jun 18 '19 at 13:54
  • Hi, @DominicXigen I didn't start to check the coding standard for my Module yet. – Shakthi Vel Jun 18 '19 at 14:13
  • Sidenote, your plugin could be an after instead of around since you are just modifying the result. Would give a slight performance increase and avoid unnecessarily increasing the call stack – Sam Jun 18 '19 at 22:19
  • Thanks, @Sam I had updated my code. – Shakthi Vel Jun 19 '19 at 4:49
  • The amount of work required to bypass the validation seems more than making sure you can pass (which is the better option in my opinion). As a first step make sure that your form has a form_key and is submitted alongside the POST request. – Kristof at Fooman Jun 20 '19 at 10:57
1

Answer #1: I'd recommend creating a webapi endpoint instead of an ajax controller. If you look at Magento core, the checkout is has many ajax calls and they all point to webapi endpoints which are defined in vendor/magento/module-checkout/etc/webapi.xml. You can define resources to make access to the controller as public or as restricted as you want.

Answer #2: Make sure that your form key is being properly submitted and check for any other requirements.

Answer #3: Maybe the easiest but absolutely one I don't recommend. However, since it works, I'll post it here. See code below.

<?php

namespace Foo\Bar\Controller\Baz;

use Magento\Framework\App\Action\Action;
use Magento\Framework\App\Request\InvalidRequestException;
use Magento\Framework\App\RequestInterface;
use Magento\Framework\App\ResponseInterface;
use Magento\Framework\Controller\ResultFactory;
use Magento\Framework\Controller\ResultInterface;

/**
 * Class Index
 *
 * @package Foo\Bar\Controller\Baz
 */
class Index extends Action implements \Magento\Framework\App\CsrfAwareActionInterface
{
    /**
     * @return ResponseInterface|ResultInterface
     */
    public function execute()
    {
        /** @var ResultInterface $result */
        $result = $this->resultFactory->create(ResultFactory::TYPE_JSON);
        $result->setData(['whatever data']);

        return $result;
    }

    /**
     * @param RequestInterface $request
     *
     * @return bool|null
     */
    public function validateForCsrf(RequestInterface $request): ?bool
    {
        return true;
    }

    /**
     * @param RequestInterface $request
     *
     * @return InvalidRequestException|null
     */
    public function createCsrfValidationException(RequestInterface $request): ?InvalidRequestException
    {
        return null;
    }
}
0

I've heard mixed things about the technical review. If your code passes the code quality check https://github.com/magento/magento-coding-standard you are with a good chance of passing.

But also as a rough guide

https://docs.magento.com/marketplace/user_guide/sellers/technical-review-guidelines.html

Quality Assurance (M2 only): Pass Manual QA

This check verifies that the extension installs without error, is configurable (as applicable), and operates as expected.

To pass Manual QA, the extension must meet the following requirements:

Installs with Composer,

Compiles without errors using the following command: deploy:mode:set production

Works with each version of Magento that is shown as supported in the extension product profile.

Works with each version of PHP that is supported by the Magento version that is shown as supported in the extension product profile.

Has all functionality that is described in the extension documentation.

Does not crash with unhandled errors.

Does not hang when invalid data is submitted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.