Cms: Option to disable CSRF protection for public facing actions

[angrybrad]

Created by: Tam McDonald ([email protected]) on 2015/07/27 09:48:32 +0000
Votes at time of UserVoice import: 1

---

It would be great to be able to disable CSRF protection for certain public facing actions; perhaps similar to protected $allowAnonymous.

I've had multiple issues where external services need to post to a callback URL, but have failed due to CSRF (i.e. SagePay, DocuSign). It would be great to be able to be able to disable CSRF for these actions (and not to have to do it awkwardly in general.php).

[MattWilcox]

+1 on this, SagePay with Commerce just bombs out if you use CSRF at the moment.

[rtrudel]

up and +1 here.

And why not a way to allow 'users/login' (or other auth-related actions) to skip CSRF when used via ajax? I know the login returns the CSRF token, but to get it, you must have a token already along login action, which make no sense on headless development.

[brandonkelly]

Controllers can disable CSRF validation completely by setting $enableCsrfValidation to false:

public $enableCsrfValidation = false;

Or if you just want to disable it for certain actions, override beforeAction():

public beforeAction($action)
{
    if ($action->id === 'save') {
        $this->enableCsrfValidation = false;
    }

    return parent::beforeAction($action);
}

public function actionSave()
{
    // this action won't require CSRF validation
}

@rtrudel whether we should disable CSRF validation for login is a separate discussion; please post as a new issue.

[j2is]

https://craftcms.stackexchange.com/questions/35449/how-to-overwrite-base-controller-beforeaction-method/35464#35464 is how to go about this specifically