Questions tagged [csrf]

Cross-Site-Request-Forgery is an attack type that forces an end user to execute unwanted actions on a web application

Filter by
Sorted by
Tagged with
0
votes
2answers
273 views

How to bypass CSRF validation for certain requests

I am trying to bypass the CSRF validation for my Controller. I had seen a few workaround in the below links. Magento 2.3 upgrade breaks HTTP POST requests to custom module endpoint But I need my ...
6
votes
2answers
886 views

How to bypass CSRF validation for certain requests like payment gateway webhook?

I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page." Upon ...
2
votes
1answer
186 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
2
votes
1answer
250 views

Error 404 after update to 1.9.2.0 - during registration

After update to 1.9.2.0 I have added the form-key to my registration template. I can see the form-key value using firebug on the registration page, but when I submit the form, I get a 404 error: ...
15
votes
2answers
3k views

Why is CSRF protection needed for add-to-cart?

Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks. So now I wonder, is it really needed for this place, and why or better said, ...
4
votes
2answers
1k views

Initial Form Key not Matching with Varnish/Turpentine in Firefox

I'm running into a weird issue with Varnish, Turpentine, and Firefox which is, in all likelihood, something very specific to the configuration of the system I'm working on. I'm asking about it here ...
7
votes
1answer
1k views

What is the form_key used for?

I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence. Everyone just worked ...
19
votes
1answer
35k views

What is getBlockHtml('formkey')?

I am trying to edit the product edit page (first tab) in Magento and would like to move the quantity (as well as a few other things) from their respective tabs up to the first page. I see <form ...
18
votes
3answers
24k views

Getting correct FormKey

I have a page that I listed products, that's it. Its kind of catalog/view.phtml clone. Just included app/Mage.php. In this page I use Mage::getSingleton('core/session')->getFormKey(); but it's ...