Questions tagged [csrf]
Cross-Site-Request-Forgery is an attack type that forces an end user to execute unwanted actions on a web application
11
questions
0
votes
1
answer
110
views
Magento2 - Secure your store from CSRF
Can anyone let me know how can I Secure store from CSRF. I am facing vulnerability issue like - Form Can Be Manipulated with Cross-Site Request Forgery (CSRF). Is this issue solved in Magento 2.4.4 ...
- 89
0
votes
1
answer
667
views
Magento 2.2: MiBPHP Fatal error: Interface 'Magento\Framework\App\CsrfAwareActionInterface' not found
i am getting error on m2.2 at the time of de validation
ch328094@lxv94:~/web/rrrr.com/public_html$ php bin/magento setup:di:compile
Compilation was started.
Repositories code generation... 1/7 [====&...
- 135
0
votes
2
answers
4k
views
How to bypass CSRF validation for certain requests
I am trying to bypass the CSRF validation for my Controller. I had seen a few workaround in the below links.
Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint
But I need my ...
9
votes
2
answers
3k
views
How to bypass CSRF validation for certain requests like payment gateway webhook?
I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page."
Upon ...
- 775
2
votes
1
answer
661
views
Is Magento 2 REST API CSRF-proof?
As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
- 140
2
votes
1
answer
277
views
Error 404 after update to 1.9.2.0 - during registration
After update to 1.9.2.0 I have added the form-key to my registration template.
I can see the form-key value using firebug on the registration page, but when I submit the form, I get a 404 error:
...
- 66
16
votes
2
answers
5k
views
Why is CSRF protection needed for add-to-cart?
Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks.
So now I wonder, is it really needed for this place, and why or better said, ...
- 6,127
4
votes
2
answers
1k
views
Initial Form Key not Matching with Varnish/Turpentine in Firefox
I'm running into a weird issue with Varnish, Turpentine, and Firefox which is, in all likelihood, something very specific to the configuration of the system I'm working on. I'm asking about it here ...
- 44.3k
9
votes
1
answer
3k
views
What is the form_key used for?
I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence.
Everyone just worked ...
- 275
20
votes
1
answer
38k
views
What is getBlockHtml('formkey')?
I am trying to edit the product edit page (first tab) in Magento and would like to move the quantity (as well as a few other things) from their respective tabs up to the first page. I see
<form ...
- 369
18
votes
3
answers
25k
views
Getting correct FormKey
I have a page that I listed products, that's it. Its kind of catalog/view.phtml clone. Just included app/Mage.php.
In this page I use
Mage::getSingleton('core/session')->getFormKey();
but it's ...
- 531