Hot answers tagged

43

Form keys in Magento are a means of preventing against Cross Site Request Forgery - explained brilliantly by Ashley Schroder here but, in short, it's to keep you safe from people trying to post to your forms (like add to cart) from other sites posing as you. This can be dangerous because someone could theoretically create their own form and post to any form ...


17

Probably nothing because the form key is random, so it has to be different each time. So it should not make a difference, but the best practice, how you should add the form key input to your template, is this: <?php echo $this->getBlockHtml('formkey') ?> Update: I have to admit, I was wrong in one point: The form key stays the same during a ...


14

I believe it will be difficult to source a definitive answer to this question of why a CSRF token is "needed" in Magento's add to cart GET action. I'll make an attempt to interpret its purpose. I'm by no means a security expert and this is my interpretation of CSRF in this particular context. Context From owasp.org Cross-Site Request Forgery (CSRF) is ...


10

It prevents Cross Site Request Forgery Cross-Site Request Forgery (CSRF) is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request. ...


8

I know this vague question should not be answered. However I might have run into a similar issue here, this is what I have learned: the form_key must not be different in each request the form_key is consistent throughout the session a different session should create a different form_key (try another browser) the PAGE CACHE does sometimes interfere with ...


5

You can add a formKey to your request. Magento checks in the validateRequest function at Magento\Framework\App\Request\CsrfValidator if the request is intance of CsrfAwareActionInterface, not a post request, ajax or has a valide formKey: private function validateRequest( HttpRequest $request, ActionInterface $action ): bool { $...


4

Web development principles say any form of cross-site request forgery (CSRF) or cross-site scripting (XSS) is undesirable and should always be avoided. What does that mean? For CSRF, you can't have any URLs that mutate stateful data in and of themselves. Otherwise an attacker could manipulate the contents of a person's cart, or add/remove items from their ...


3

Seems like you put an error in the template: The URL should be /customer/account/createPost (capital P)


1

Answer #1: I'd recommend creating a webapi endpoint instead of an ajax controller. If you look at Magento core, the checkout is has many ajax calls and they all point to webapi endpoints which are defined in vendor/magento/module-checkout/etc/webapi.xml. You can define resources to make access to the controller as public or as restricted as you want. Answer ...


1

After some deeper researching I found out that Magento 2 REST API that is used on checkout page appears to be CSRF-proof and does not need an additional anti-CSRF token. The reason is that PHP session ID (PHPSESSID) is regenerated for each checkout page and is therefore unique, so no form_key is needed.


1

This could be related to external cache as initially formkey is not matching. Try to unset the product view block from cache. <reference name="content"> <block type="catalog/product_view" name="product.info" template="catalog/product/view.phtml"> <action method="unsetData"><key>cache_lifetime</key></action> ...


1

Having the same form key doesn't seem to cause me issues on chrome. (We're not using Turpentine but instead using some custom varnish configuration) Having said that we have a pass rule setup in varnish for anything on the checkout You could add something similar on a wilcard of checkout/cart/add which might do the trick.


1

Can't comment so I'm answering instead. Don't add the form key in the controller. It disables the security benefits of the form key. If you are using Varnish you can use ESI (Edge Side Includes) to add the key. You'll have to save it in a cookie for that to work.


Only top voted, non community-wiki answers of a minimum length are eligible