Questions tagged [csrf]

Cross-Site-Request-Forgery is an attack type that forces an end user to execute unwanted actions on a web application

Filter by
Sorted by
Tagged with
19
votes
1answer
35k views

What is getBlockHtml('formkey')?

I am trying to edit the product edit page (first tab) in Magento and would like to move the quantity (as well as a few other things) from their respective tabs up to the first page. I see <form ...
7
votes
2answers
1k views

How to bypass CSRF validation for certain requests like payment gateway webhook?

I am trying to integrate CC avenue payment method with Magento 2.3 however once payment is processed, user is navigated back to website with error "Invalid Form Key. Please refresh the page." Upon ...
15
votes
2answers
4k views

Why is CSRF protection needed for add-to-cart?

Magento has since recent versions a form_key as part of the add to cart action, to protect against I think CSRF attacks. So now I wonder, is it really needed for this place, and why or better said, ...
7
votes
1answer
1k views

What is the form_key used for?

I really don't understand the form_key feature. I have found several sites asking and dealing with issues about the form_key but none explained the reason for it's existence. Everyone just worked ...