blocks|key|2720050|text|注意:由于我的答案建议禁用跨站点请求伪造(https://www.owasp.org/index.php/Cross-Site(CSRF%2529))，请参阅以正确的方式解决此问题|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2720051|2720052|你对enableCsrfValidation有问题。要了解更多信息，可以阅读here。|2720053|要禁用CSRF，请将以下代码添加到您的控制器：|2720054|public+function+beforeAction($action)+{
++++$this->enableCsrfValidation+=+false;
++++return+parent::beforeAction($action);
}|code-block|syntax|javascript|2720055|这将对所有操作禁用。您可能应该根据$action的不同，仅针对特定操作禁用它。|2720056|entityMap|0|LINK|mutability|MUTABLE|url|https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF%2529)_._|1|http://www.yiiframework.com/doc-2.0/yii-web-controller.html#$enableCsrfValidation-detail^0|L|1F|0|0|0|12|4|1|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@$A|10|B|11|1|12]]|C|$]]|$1|D|3|-4|5|6|7|13|8|@]|9|@]|C|$]]|$1|E|3|F|5|6|7|14|8|@]|9|@$A|15|B|16|1|17]]|C|$]]|$1|G|3|H|5|6|7|18|8|@]|9|@]|C|$]]|$1|I|3|J|5|K|7|19|8|@]|9|@]|C|$L|M]]|$1|N|3|O|5|6|7|1A|8|@]|9|@]|C|$]]|$1|P|3|-4|5|6|7|1B|8|@]|9|@]|C|$]]]|Q|$R|$5|S|T|U|C|$V|W]]|X|$5|S|T|U|C|$V|Y]]]]

Note: See <a href="https://stackoverflow.com/questions/27126050/getting-bad-request-400-on-ajax-calls-using-yii-2/27248827#27248827">the answer from Skullcrasher</a> to fix the issue in the correct way as my answer suggests disabling the <a href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)" rel="noreferrer">Cross-Site Request Forgery</a>.

<hr>

You have a problem with enableCsrfValidation. To read more about it you can read <a href="http://www.yiiframework.com/doc-2.0/yii-web-controller.html#$enableCsrfValidation-detail" rel="noreferrer">here</a>.

To disable CSRF, add this code to your controller:

<pre><code>public function beforeAction($action) {
 $this-&gt;enableCsrfValidation = false;
 return parent::beforeAction($action);
}
</code></pre>

This will disable for all actions. You should probably, depending on the $action, disable it only for specific actions.

blocks|key|146252|text|正如Mihai+P.的回答所述，您的问题是CSRF验证。您也可以为您的操作禁用验证，但这不是一个好的解决方案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|146253|由于Ajax请求中存在验证问题，因此还可以使用Yii+JavaScript函数将CSRF令牌添加到在Ajax请求中发送的表单数据中。|146254|只需尝试将令牌添加到表单数据中，如下所示：|146255|var+form_data+=+{
++++zone:+zoneId,
++++_csrf:+yii.getCsrfToken()
};|code-block|syntax|javascript|146256|我希望这会有所帮助，因此您不必禁用CSRF验证。|146257|除了手动添加CSRF令牌之外，您还可以检查请求中是否设置了X-CSRF头。|146258|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|T|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|V|8|@]|9|@]|A|$]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

As the answer from Mihai P. states, your problem is CSRF validation. It is also true that you could disable the validation for your actions, but this is not considered a good solution.

As you have a problem in your Ajax request with the validation, you could also use a Yii JavaScript function to add the CSRF token to your formdata that you send in the Ajax request.

Just try to add the token to your form data as follows:

<pre><code>var form_data = {
 zone: zoneId,
 _csrf: yii.getCsrfToken()
};
</code></pre>

I hope this helps and you therefore don't have to disable CSRF validation.

In addition to manually add the CSRF token you can check if there is an X-CSRF header set in the request.

blocks|key|142689|text|使用：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|142690|var+csrfToken+=+$('meta[name="csrf-token"]').attr("content");
$.ajax({
++++url:+'request',
++++type:+'post',
++++dataType:+'json',
++++data:+{param1:+param1,+_csrf+:+csrfToken},
});|code-block|syntax|javascript|142691|更多细节：|142692|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Use:

<pre><code>var csrfToken = $('meta[name="csrf-token"]').attr("content");
$.ajax({
 url: 'request',
 type: 'post',
 dataType: 'json',
 data: {param1: param1, _csrf : csrfToken},
});
</code></pre>

More detail: <a href="https://www.codesiri.com/2015/01/yii2-using-csrf-token.html" rel="nofollow noreferrer">Yii2: Using csrf token</a>

blocks|key|2932677|text|在布局的底部添加以下代码：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2932678|<script>
++++$.ajaxSetup({
++++++++data:+<?=+\yii\helpers\Json::encode([
++++++++++++\yii::$app->request->csrfParam+=>+\yii::$app->request->csrfToken,
++++++++])+?>
++++});
</script>|code-block|syntax|javascript|2932679|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Add this code at the bottom of your layout:

<pre><code>&lt;script&gt;
 $.ajaxSetup({
 data: &lt;?= \yii\helpers\Json::encode([
 \yii::$app-&gt;request-&gt;csrfParam =&gt; \yii::$app-&gt;request-&gt;csrfToken,
 ]) ?&gt;
 });
&lt;/script&gt;
</code></pre>

blocks|key|2932687|text|这是可行的。在Config/main.php中更改您自己的csrfParam|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2932688|'components'+=>+[
++++'request'=>[
++++++++'csrfParam'=>"othername"
++++],
++++...|code-block|syntax|javascript|2932689|请记住，您必须在请求中包含与您在config中定义的名称相同的令牌。|2932690|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

This works. Change the csrfParam with your own
in Config/main.php

<pre><code>'components' =&gt; [
 'request'=&gt;[
 'csrfParam'=&gt;"othername"
 ],
 ...
</code></pre>

Remember that you must include in your requests the token with the same name as you defined in config.

blocks|key|2932697|text|您需要在操作前功能中禁用CSRF验证：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2932698|public+function+beforeAction($action)+{
++++if($action->id+==+"action+name+need+to+disable")
++++++++$this->enableCsrfValidation+=+false;
++++return+parent::beforeAction($action);
}|code-block|syntax|javascript|2932699|或者使用GET+method。|offset|length|2932700|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Request_methods^0|0|0|4|A|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

You need to disable CSRF validation in the before action function:

<pre><code>public function beforeAction($action) {
 if($action-&gt;id == "action name need to disable")
 $this-&gt;enableCsrfValidation = false;
 return parent::beforeAction($action);
}
</code></pre>

Or using the <a href="http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol#Request_methods" rel="nofollow noreferrer">GET method</a>.

blocks|key|144980|text|/backend/config/main-local.php|type|unstyled|depth|inlineStyleRanges|entityRanges|data|144981|'components'+=>+[
++++'request'+=>+[
++++++++'cookieValidationKey'+=>+'unique+code',
++++++++'csrfCookie'+=>+['httpOnly'+=>+true,+'path'+=>+'/admin/'],
++++],
],|code-block|syntax|javascript|144982|/前端/config/main-local.php|144983|'components'+=>+[
++++'request'+=>+[
++++++++'cookieValidationKey'+=>+'unique+code',
++++++++'csrfCookie'+=>+['httpOnly'+=>+true,+'path'+=>+'/'],
++++],
],|144984|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|N|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

/backend/config/main-local.php

<pre><code>'components' =&gt; [
 'request' =&gt; [
 'cookieValidationKey' =&gt; 'unique code',
 'csrfCookie' =&gt; ['httpOnly' =&gt; true, 'path' =&gt; '/admin/'],
 ],
],
</code></pre>

/frontend/config/main-local.php

<pre><code>'components' =&gt; [
 'request' =&gt; [
 'cookieValidationKey' =&gt; 'unique code',
 'csrfCookie' =&gt; ['httpOnly' =&gt; true, 'path' =&gt; '/'],
 ],
],
</code></pre>

blocks|key|2932775|text|虽然这是一个有很多答案的老帖子，但是所有的答案中都缺少一些东西，所有的答案都是正确的，但是在调用ajax+POST请求和数据时，您应该使用提供的yii.js函数|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2932776|2932777|yii.getCsrfParam()用于获取令牌的参数名称以获取csrf-+token|unordered-list-item|2932778|yii.getCsrfToken()+|2932779|的token或实际值|2932780|就好像您在request组件配置下的config.php或web.php中为前端定义了不同的参数名称|2932781|components=>[
.......
.......
++++'request'+=>+[
++++++++'csrfParam'+=>+'_csrf-frontend',
++++],
.......
.......
]|code-block|syntax|javascript|2932782|然后，您需要动态获取该名称，上面的函数将为您提供帮助。|2932783|你应该|2932784|var+form_data+=+{
++++zone:+zoneId
};
form_data[yii.getCsrfParam()]=yii.getCsrfToken();|2932785|entityMap^0|1H|4|20|6|0|0|0|I|0|0|I|0|0|5|7|I|A|T|7|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@$9|13|A|14|B|C]|$9|15|A|16|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|17|8|@]|D|@]|E|$]]|$1|G|3|H|5|I|7|18|8|@$9|19|A|1A|B|C]]|D|@]|E|$]]|$1|J|3|K|5|I|7|1B|8|@$9|1C|A|1D|B|C]]|D|@]|E|$]]|$1|L|3|M|5|6|7|1E|8|@]|D|@]|E|$]]|$1|N|3|O|5|6|7|1F|8|@$9|1G|A|1H|B|C]|$9|1I|A|1J|B|C]|$9|1K|A|1L|B|C]]|D|@]|E|$]]|$1|P|3|Q|5|R|7|1M|8|@]|D|@]|E|$S|T]]|$1|U|3|V|5|6|7|1N|8|@]|D|@]|E|$]]|$1|W|3|X|5|6|7|1O|8|@]|D|@]|E|$]]|$1|Y|3|Z|5|R|7|1P|8|@]|D|@]|E|$S|T]]|$1|10|3|-4|5|6|7|1Q|8|@]|D|@]|E|$]]]|11|$]]

Although it is an old post with alot of answers but there is something missing from all the answers posted, all of them addressed the correct point but when calling the ajax <code>POST</code> request along with your data you should use the <code>yii.js</code> functions provided

<ul>
<li><code>yii.getCsrfParam()</code> to get the parameter name of the token</li>
<li><code>yii.getCsrfToken()</code> to get the token or actual value of the csrf-token</li>
</ul>

As if you have different param name for front-end defined inside the <code>config.php</code> or <code>web.php</code> under the <code>request</code> components configurations 

<pre><code>components=&gt;[
.......
.......
 'request' =&gt; [
 'csrfParam' =&gt; '_csrf-frontend',
 ],
.......
.......
]
</code></pre>

then you need to get that name dynamically and the above function help you out.

You should 

<pre><code>var form_data = {
 zone: zoneId
};
form_data[yii.getCsrfParam()]=yii.getCsrfToken();
</code></pre>

This is my code:

<pre><code>$(document).on('change', '#tblhotel-int_zone_id', function(e){
 var zoneId = $(this).val();
 var form_data = {
 zone: zoneId
 };
 $.ajax({
 url: "state",
 type: "POST",
 data: form_data,
 success: function(response)
 {
 alert(response);
 }
 });
});
</code></pre>

This shows:

<blockquote>
 Bad Request (#400): Unable to verify your data submission.
</blockquote>

And I already have <code>&lt;?= Html::csrfMetaTags() ?&gt;</code>. How can I fix this problem?

Getting bad request (#400) on Ajax calls using Yii 2

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

这是我的代码：$(document).on('change', '#tblhotel-int_zone_id', function(e){    var zoneId = $(this).val();    var form_data = {        zone: zoneId    };    $.ajax({ ...

问使用Yii 2在Ajax调用上获得错误请求(#400)
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Yii 2在Ajax调用上获得错误请求(#400)EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用Yii 2在Ajax调用上获得错误请求(#400)
EN