blocks|key|2853066|text|CSRF组件将当前token作为_csrfToken写入请求参数，您可以通过请求对象的param()方法(或CakePHP+3.4中的getParam()+)获取：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2853067|beforeSend:+function(xhr){
++++xhr.setRequestHeader(
++++++++'X-CSRF-Token',
++++++++<?=+json_encode($this->request->param('_csrfToken'));+?>
++++);
},|code-block|syntax|javascript|2853068|要使令牌对所有脚本可用，例如，可以使其作为布局模板中的变量全局可用：|2853069|<script>
var+csrfToken+=+<?=+json_encode($this->request->param('_csrfToken'))+?>;
//+...
<script>|2853070|然后，您可以轻松地在所有AJAX请求中使用它：|2853071|setRequestHeader('X-CSRF-Token',+csrfToken);|2853072|可以通过从控制器事件管理器中删除CSRF组件来禁用它。你必须计算出你需要在什么条件下这样做，例如，对于一个特定的操作，就像这样：|2853073|public+function+beforeFilter(\Cake\Event\Event+$event)
{
++++parent::beforeFilter($event);

++++if+($this->request->param('action')+===+'actionXyz')+{
++++++++$this->eventManager()->off($this->Csrf);
++++}
}|2853074|如果您使用的是CSRF中间件，那么令牌仍然可以作为名为_csrfToken的请求参数使用，但是禁用中间件的工作方式有所不同，请参见示例|2853075|另请参阅|2853076|2853077|unordered-list-item|2853078|2853079|2853080|2853081|entityMap^0|G|A|17|7|1V|A|0|0|0|0|0|0|0|0|R|A|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|18|8|@$9|19|A|1A|B|C]|$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|1F|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1G|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|1H|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|1I|8|@]|D|@]|E|$]]|$1|Q|3|R|5|H|7|1J|8|@]|D|@]|E|$I|J]]|$1|S|3|T|5|6|7|1K|8|@]|D|@]|E|$]]|$1|U|3|V|5|H|7|1L|8|@]|D|@]|E|$I|J]]|$1|W|3|X|5|6|7|1M|8|@$9|1N|A|1O|B|C]]|D|@]|E|$]]|$1|Y|3|Z|5|6|7|1P|8|@]|D|@]|E|$]]|$1|10|3|-4|5|6|7|1Q|8|@]|D|@]|E|$]]|$1|11|3|-4|5|12|7|1R|8|@]|D|@]|E|$]]|$1|13|3|-4|5|12|7|1S|8|@]|D|@]|E|$]]|$1|14|3|-4|5|12|7|1T|8|@]|D|@]|E|$]]|$1|15|3|-4|5|6|7|1U|8|@]|D|@]|E|$]]|$1|16|3|-4|5|6|7|1V|8|@]|D|@]|E|$]]]|17|$]]

The CSRF component writes the current token to the request parameters as <code>_csrfToken</code>, you can get it via the request object's <code>param()</code> method (or <code>getParam()</code> as of CakePHP 3.4):
<pre class="lang-js prettyprint-override"><code>beforeSend: function(xhr){
 xhr.setRequestHeader(
 'X-CSRF-Token',
 &lt;?= json_encode($this-&gt;request-&gt;param('_csrfToken')); ?&gt;
 );
},
</code></pre>
To make the token available to all your scripts, you can for example make it globally available as variable in your layout template:
<pre class="lang-html prettyprint-override"><code>&lt;script&gt;
var csrfToken = &lt;?= json_encode($this-&gt;request-&gt;param('_csrfToken')) ?&gt;;
// ...
&lt;script&gt;
</code></pre>
You can then easily use it in all your AJAX requests:
<pre class="lang-js prettyprint-override"><code>setRequestHeader('X-CSRF-Token', csrfToken);
</code></pre>
The CSRF component can be disabled by removing it from the controllers event manager. You'll have to figure on what condition you'd need to do that, for example for a specific action, like this:
<pre><code>public function beforeFilter(\Cake\Event\Event $event)
{
 parent::beforeFilter($event);

 if ($this-&gt;request-&gt;param('action') === 'actionXyz') {
 $this-&gt;eventManager()-&gt;off($this-&gt;Csrf);
 }
}
</code></pre>
If you're using the CSRF middleware, then the token is still available as a request parameter named <code>_csrfToken</code>, disabling the middleware however works differently, see for example <a href="https://stackoverflow.com/questions/47714940/cakephp-3-5-6-disable-csrf-middleware-for-controller">Cakephp 3.5.6 disable CSRF Middleware for controller</a>
See also
<ul>
<li><a href="https://book.cakephp.org/3.0/en/controllers/request-response.html#request-parameters" rel="nofollow noreferrer">Cookbook &gt; Request &amp; Response Objects &gt; Request Parameters</a></li>
<li><a href="https://book.cakephp.org/3.0/en/controllers/components/csrf.html#using-the-csrfcomponent" rel="nofollow noreferrer">Cookbook &gt; Controllers &gt; Components &gt; CSRF &gt; Using the CsrfComponent</a></li>
<li><a href="https://book.cakephp.org/3.0/en/controllers/components/csrf.html#csrf-protection-and-ajax-requests" rel="nofollow noreferrer">Cookbook &gt; Controllers &gt; Components &gt; CSRF &gt; Disabling the CSRF Component for Specific Actions</a></li>
</ul>

blocks|key|2853103|text|每个表单都有一个隐藏的_csrfToken字段，当您启用Csrf组件时会自动添加该字段。现在，您可以像$('[name="_csrfToken"]').val()一样通过jquery轻松地获取该字段的令牌。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2853104|ajax调用将如下所示：|2853105|$.ajax({
+++url:+'someUrl',
+++headers+:+{
++++++'X-CSRF-Token':+$('[name="_csrfToken"]').val()
+++},
+++type:+'post',
+++...
});|code-block|syntax|javascript|2853106|entityMap^0|B|A|1F|U|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|T|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|U|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

Every form has a hidden <code>_csrfToken</code> field that's automatically added when you have enabled the Csrf component. Now you can easily get the token of this field by jquery like <code>$('[name="_csrfToken"]').val()</code>.

A ajax call will look like this: 

<pre><code>$.ajax({
 url: 'someUrl',
 headers : {
 'X-CSRF-Token': $('[name="_csrfToken"]').val()
 },
 type: 'post',
 ...
});
</code></pre>

blocks|key|102718|text|CakePHP+3|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|102719|102720|请不要为任何特定操作解锁字段/禁用CSRF安全组件。这对于表单的安全性很重要。|blockquote|102721|102722|对于那些正在获取的人来说，“该请求已被黑洞。”，“表单篡改错误”，“您无权访问该位置。”或“POST数据中的意外字段”。这主要是由于CSRF组件可以正常工作。|102723|102724|禁用或修改它不是解决方案。请遵循正确的方法，而不是禁用。在上面的情况下，请尝试序列化表单，这应该会有魔力。|102725|var+el+=+$("#xyzForm");

var+ajaxTPCalls+=+el.serializeArray();
++$.ajax({
++++++++++++++++++++++++++++type:+el.attr('method'),
++++++++++++++++++++++++++++async:+true,
++++++++++++++++++++++++++++url:++el.attr('action'),
++++++++++++++++++++++++++++data:+ajaxTPCalls,
++++++++++++++++++++++++++++dataType:+"json",
++++++++++++++++++++++++++++cache:+false,
++++++++++++++++++++++++++++success:+function+(data)+{

++++++++++++++++++++++++++++++++toastr.success(data.message,+data.title);
++++++++++++++++++++++++++++},
++++++++++++++++++++++++++++error:+function+(jqXHR)+{
++++++++++++++++++++++++++++++++if+(jqXHR.status+==+403)+{
++++++++++++++++++++++++++++++++++++$("body").html(jqXHR.responseText);
++++++++++++++++++++++++++++++++}
++++++++++++++++++++++++++++}
++++++++++++++++++++++++});|code-block|syntax|javascript|102726|通过这种方式，您不会禁用CSRF，也不会解锁任何字段。|102727|entityMap^0|0|9|0|0|0|0|8|F|O|8|X|B|19|E|0|0|0|0|A|H|0^^$0|@$1|2|3|4|5|6|7|Y|8|@$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|11|8|@]|D|@]|E|$]]|$1|G|3|H|5|I|7|12|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|13|8|@]|D|@]|E|$]]|$1|K|3|L|5|6|7|14|8|@$9|15|A|16|B|C]|$9|17|A|18|B|C]|$9|19|A|1A|B|C]|$9|1B|A|1C|B|C]]|D|@]|E|$]]|$1|M|3|-4|5|6|7|1D|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|1E|8|@]|D|@]|E|$]]|$1|P|3|Q|5|R|7|1F|8|@]|D|@]|E|$S|T]]|$1|U|3|V|5|6|7|1G|8|@$9|1H|A|1I|B|C]]|D|@]|E|$]]|$1|W|3|-4|5|6|7|1J|8|@]|D|@]|E|$]]]|X|$]]

CakePHP 3

<blockquote>
 Please do not unlock fields/disable CSRF security component for any
 particular action. This is important for the form security.
 
 for those who are getting "The request has been black-holed."
 ,"form tampered error", "you are not authorized to access
 that location." or "unexpected field in POST data". It is
 mainly due to the CSRF component working as expected.
</blockquote>

Disabling or modifying it is not a solution. Instead of disabling, please follow the right approach. 
In above case, please try serializing the form and that should do the magic. 

<pre><code>var el = $("#xyzForm");

var ajaxTPCalls = el.serializeArray();
 $.ajax({
 type: el.attr('method'),
 async: true,
 url: el.attr('action'),
 data: ajaxTPCalls,
 dataType: "json",
 cache: false,
 success: function (data) {

 toastr.success(data.message, data.title);
 },
 error: function (jqXHR) {
 if (jqXHR.status == 403) {
 $("body").html(jqXHR.responseText);
 }
 }
 });
</code></pre>

This way you do not disable CSRF or unlock any field.

In Cakephp3 when the Csrf component is enabled. How I can use it in ajax call.
In this <code>beforeSend</code> parameter of ajax csrf token is set in header. What is the value of <code>csrfToken</code>. As it gives error

<blockquote>
 csrfToken is not defined
</blockquote>

<pre><code>beforeSend: function(xhr){
 xhr.setRequestHeader('X-CSRF-Token', csrfToken);
},
</code></pre>

Also how can I disable Csrf component for some ajax calls.

How to define CSRF token in ajax call in Cakephp 3. Also How CSRF can be off for some ajax requests

中间件

在Cakephp3中启用Csrf组件时。如何在ajax调用中使用它。在此beforeSend中，ajax的csrf令牌参数设置在header中。csrfToken的价值是什么？因为它给出了错误未定义 csrfTokenbeforeSend: function(xhr){    xhr.setRequestHeader(...

问如何在Cakephp 3中定义ajax调用中的CSRF令牌。另外，如何为某些ajax请求关闭CSRF
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Cakephp 3中定义ajax调用中的CSRF令牌。另外，如何为某些ajax请求关闭CSRFEN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Cakephp 3中定义ajax调用中的CSRF令牌。另外，如何为某些ajax请求关闭CSRF
EN