Questions tagged [csrf]

Cross-Site-Request-Forgery is an attack type that forces an end user to execute unwanted actions on a web application

Filter by
Sorted by
Tagged with
0 votes
1 answer

Magento2 - Secure your store from CSRF

Can anyone let me know how can I Secure store from CSRF. I am facing vulnerability issue like - Form Can Be Manipulated with Cross-Site Request Forgery (CSRF). Is this issue solved in Magento 2.4.4 ...
user3411's user avatar
0 votes
1 answer

Magento 2.2: MiBPHP Fatal error: Interface 'Magento\Framework\App\CsrfAwareActionInterface' not found

i am getting error on m2.2 at the time of de validation ch328094@lxv94:~/web/$ php bin/magento setup:di:compile Compilation was started. Repositories code generation... 1/7 [====&...
Shiv Singh's user avatar
0 votes
2 answers

How to bypass CSRF validation for certain requests

I am trying to bypass the CSRF validation for my Controller. I had seen a few workaround in the below links. Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint But I need my ...
Shakthi Vel's user avatar
9 votes
2 answers

How to bypass CSRF validation for certain requests like payment gateway webhook?

I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page." Upon ...
Rizwan Dhuka's user avatar
2 votes
1 answer

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
xpoback's user avatar
  • 140
2 votes
1 answer

Error 404 after update to - during registration

After update to I have added the form-key to my registration template. I can see the form-key value using firebug on the registration page, but when I submit the form, I get a 404 error: ...
Al Moonsur's user avatar
16 votes
2 answers

Why is CSRF protection needed for add-to-cart?

Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks. So now I wonder, is it really needed for this place, and why or better said, ...
Flyingmana's user avatar
  • 6,127
4 votes
2 answers

Initial Form Key not Matching with Varnish/Turpentine in Firefox

I'm running into a weird issue with Varnish, Turpentine, and Firefox which is, in all likelihood, something very specific to the configuration of the system I'm working on. I'm asking about it here ...
Alana Storm's user avatar
  • 44.3k
9 votes
1 answer

What is the form_key used for?

I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence. Everyone just worked ...
Summer-Sky's user avatar
20 votes
1 answer

What is getBlockHtml('formkey')?

I am trying to edit the product edit page (first tab) in Magento and would like to move the quantity (as well as a few other things) from their respective tabs up to the first page. I see <form ...
new2programming's user avatar
18 votes
3 answers

Getting correct FormKey

I have a page that I listed products, that's it. Its kind of catalog/view.phtml clone. Just included app/Mage.php. In this page I use Mage::getSingleton('core/session')->getFormKey(); but it's ...
Ibrahim Mumcu's user avatar