Yii2: Bad Request 400

Created on 12 Jun 2015  路  14Comments  路  Source: yiisoft/yii2

My application have display this message sometimes.
I use latest Yii2 basic template.
From the solution that I have found, they said the problem can be fixed by clearing the cookies and session, but the problem still exists, after sometime.

The most frequent browser to display this error is Google Chrome, firefox is not that frequent.

badrequest

Until now i don't even know what causes the problem.

need more info
Source
picture sanusi87

Most helpful comment

My Config Backend Advanced App Session Independent (Backend y Frontend):

.htaccess root app:
    # prevent directory listings
    Options -Indexes
    IndexIgnore */*

    # follow symbolic links
    Options FollowSymlinks
    RewriteEngine on

    RewriteRule ^admin(/.+)?$ /backend/web/$1 [L,PT]
    RewriteRule ^(admin)/$ /$1 [L,R=301]
    RewriteRule ^(.+)?$ /frontend/web/$1

.htaccess App Backend:

    # if a directory or a file exists, use the request directly
    # otherwise forward the request to index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . index.php

main.php:

        // Configuration [Backend - IntraCheck] //
       'id' => 'intracheck-backend',
       'basePath' => dirname(__DIR__),
       'homeUrl' => '/admin',
       'controllerNamespace' => 'backend\controllers',
       'components' => [
           // Configuration [User - Backend] //
           'user' => [
               'enableAutoLogin' => true,
               'identityCookie' => [
                   'name' => '_backendIdentity',
                   'path' => '/admin',
                   'httpOnly' => true,
               ],
           ],
           // Configuration [Session - Backend] //
          'session' => [
          'name' => 'BACKENDSESSID',
          'cookieParams' => [
              'httpOnly' => true,
              'path' => '/admin',
           ],
        ],
        // Configuration [Request - Backend] //
        'request' => [
            // !!! insert a secret key in the following (if it is empty) - this is required by cookie validation
            'baseUrl' => '/admin',
            'enableCookieValidation' => false,
            'enableCsrfValidation' => true,
            'cookieValidationKey' => '4UAJIduNxC5zlD4S_IIRofBKFWAyUzAz',
            'csrfParam' => '_backendCSRF',
            'csrfCookie' => [
                'httpOnly' => true,
                'path' => '/admin',
            ],
        ],

If 'enableCookieValidation' => true, Error Bad Request 400, if 'enableCookieValidation' => false work fine, before work fine yii v. 2.0.5 dev, PHP 5.6.6., Apache 2.4.12.

Solved: in config session cookie param 'httpOnly' -> false and 'enableCookieValidation' => true and 'enableCsrfValidation' => true work fine, if 'httpOnly' -> true and 'enableCookieValidation' => true and 'enableCsrfValidation' => true no works,

Thks,

picture tecnologiaterabyte on 17 Jun 2015
👍2 ❤1

All 14 comments

Can you enable stack trace?

usualdesigner picture usualdesigner on 12 Jun 2015

It can be caused by csrf token validation faild

lichunqiang picture lichunqiang on 15 Jun 2015

also I have the same problem with 2.0.5 dev,

Log Yii2:

2015-06-16 05:53:20 [192.168.1.101][-][-][error][yiiwebHttpException:400] exception 'yiiwebBadRequestHttpException' with message 'Incapaz de verificar los datos enviados.' in C:websintracheckvendoryiisoftyii2webController.php:110
Stack trace:

0 C:websintracheckvendoryiisoftyii2baseController.php(149): yiiwebController->beforeAction(Object(yiibaseInlineAction))

1 C:websintracheckvendoryiisoftyii2baseModule.php(455): yiibaseController->runAction('login', Array)

2 C:websintracheckvendoryiisoftyii2webApplication.php(84): yiibaseModule->runAction('user/security/l...', Array)

3 C:websintracheckvendoryiisoftyii2baseApplication.php(375): yiiwebApplication->handleRequest(Object(yiiwebRequest))

4 C:websintracheckbackendwebindex.php(18): yiibaseApplication->run()

5 {main}

2015-06-16 05:53:19 [192.168.1.101][-][-][info][application] $_POST = [
'_backendCSRF' => 'aVJCTW9GVVYfYBYXKhw6NA45Mg9dczIsLw04IQcAJWFbGTsDWSw8GA=='
'login-form' => [
'login' => 'myuser'
'password' => 'my password'
'reCaptcha' => '03AHJ_VutL3E3k1jnPb0oX7J1zm4qd-o0CETgWf9SiuGulSFfoYifQYKgS3IMWABtShmzJKylpTRtOJp491UFtQiWaVsN2CzI7NDaAZdYIx5fS8vVYjivu_dJtTtKDnb0TNUNTVSdpg2kZKJAtnTMHq_oXiLgrBamqyI_lpgE1CYB9lQmre4qrQnEm3cpnw86WmgdfGhhonZuDX_CA64wsluSKGMn4rZP6CHTkvoDAvoAB7mgwuzm0sPrroZ072lgUApu8LxNfkUbhU3bAKU-YeQg2VG_79Dsgz6m0RLPsD6Xs4iy5lvMdKK8oKuWYD1-lbNfR1wDjRuHH_ZPZY-gZB8R9EnfjetT0HP-oyRlw1KLe2ZuiFb-dWIEXeOSWCbMFHu7mkRN8KN3nd9xqHSGmWwsGFbou1xcy9Tf-mXg7DWj9X8-yObEI5nVLM7qqTeXMjnAsWMtA0ksWqWIsz_f9_gEMWJLN498zKA'
'rememberMe' => '0'
]
'g-recaptcha-response' => '03AHJ_VutL3E3k1jnPb0oX7J1zm4qd-o0CETgWf9SiuGulSFfoYifQYKgS3IMWABtShmzJKylpTRtOJp491UFtQiWaVsN2CzI7NDaAZdYIx5fS8vVYjivu_dJtTtKDnb0TNUNTVSdpg2kZKJAtnTMHq_oXiLgrBamqyI_lpgE1CYB9lQmre4qrQnEm3cpnw86WmgdfGhhonZuDX_CA64wsluSKGMn4rZP6CHTkvoDAvoAB7mgwuzm0sPrroZ072lgUApu8LxNfkUbhU3bAKU-YeQg2VG_79Dsgz6m0RLPsD6Xs4iy5lvMdKK8oKuWYD1-lbNfR1wDjRuHH_ZPZY-gZB8R9EnfjetT0HP-oyRlw1KLe2ZuiFb-dWIEXeOSWCbMFHu7mkRN8KN3nd9xqHSGmWwsGFbou1xcy9Tf-mXg7DWj9X8-yObEI5nVLM7qqTeXMjnAsWMtA0ksWqWIsz_f9_gEMWJLN498zKA'
]

$_COOKIE = [
'BACKENDSESSID' => '5rki86btckctfobj540lclva93'
]

$_SESSION = [
'__flash' => []
'__returnUrl' => '/admin'
]

$_SERVER = [
'REDIRECT_REDIRECT_STATUS' => '200'
'REDIRECT_STATUS' => '200'
'HTTP_HOST' => 'www.intracheck.tk'
'HTTP_CONNECTION' => 'keep-alive'
'CONTENT_LENGTH' => '1181'
'HTTP_CACHE_CONTROL' => 'max-age=0'
'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8'
'HTTP_ORIGIN' => 'http://www.intracheck.tk'
'HTTP_USER_AGENT' => 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36'
'CONTENT_TYPE' => 'application/x-www-form-urlencoded'
'HTTP_REFERER' => 'http://www.intracheck.tk/admin/login.html'
'HTTP_ACCEPT_ENCODING' => 'gzip, deflate'
'HTTP_ACCEPT_LANGUAGE' => 'es-ES,es;q=0.8,en;q=0.6,gl;q=0.4,und;q=0.2,ru;q=0.2'
'HTTP_COOKIE' => 'BACKENDSESSID=5rki86btckctfobj540lclva93'
'PATH' => 'C:Perl64sitebin;C:Perl64bin;C:imagemagick;C:ImageMagick;C:Windowssystem32;C:Windows;C:WindowsSystem32Wbem;C:WindowsSystem32WindowsPowerShellv1.0;C:ProgramDataComposerSetupbin;C:Php;C:phppear;C:Program FilesMicrosoft SQL Server110ToolsBinn;C:UsersTerabyte7AppDataRoamingComposervendorbin;C:Program Files (x86)Gitbin;'
'SystemRoot' => 'C:Windows'
'COMSPEC' => 'C:Windowssystem32cmd.exe'
'PATHEXT' => '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC'
'WINDIR' => 'C:Windows'
'SERVER_SIGNATURE' => ''
'SERVER_SOFTWARE' => 'Apache/2.4.12 (Win64)'
'SERVER_NAME' => 'www.intracheck.tk'
'SERVER_ADDR' => '192.168.1.101'
'SERVER_PORT' => '80'
'REMOTE_ADDR' => '192.168.1.101'
'DOCUMENT_ROOT' => 'C:/webs/intracheck'
'REQUEST_SCHEME' => 'http'
'CONTEXT_PREFIX' => ''
'CONTEXT_DOCUMENT_ROOT' => 'C:/webs/intracheck'
'SERVER_ADMIN' => 'root@localhost'
'SCRIPT_FILENAME' => 'C:/webs/intracheck/backend/web/index.php'
'REMOTE_PORT' => '49402'
'REDIRECT_URL' => '/backend/web//login.html'
'GATEWAY_INTERFACE' => 'CGI/1.1'
'SERVER_PROTOCOL' => 'HTTP/1.1'
'REQUEST_METHOD' => 'POST'
'QUERY_STRING' => ''
'REQUEST_URI' => '/admin/login.html'
'SCRIPT_NAME' => '/backend/web/index.php'
'PHP_SELF' => '/backend/web/index.php'
'REQUEST_TIME_FLOAT' => 1434450199.981
'REQUEST_TIME' => 1434450199
]
2015-06-16 06:01:26 [192.168.1.101][-][-][error][yiiwebHttpException:400] exception 'yiiwebBadRequestHttpException' with message 'Incapaz de verificar los datos enviados.' in C:websintracheckvendoryiisoftyii2webController.php:110
Stack trace:

0 C:websintracheckvendoryiisoftyii2baseController.php(149): yiiwebController->beforeAction(Object(yiibaseInlineAction))

1 C:websintracheckvendoryiisoftyii2baseModule.php(455): yiibaseController->runAction('login', Array)

2 C:websintracheckvendoryiisoftyii2webApplication.php(84): yiibaseModule->runAction('user/security/l...', Array)

3 C:websintracheckvendoryiisoftyii2baseApplication.php(375): yiiwebApplication->handleRequest(Object(yiiwebRequest))

4 C:websintracheckbackendwebindex.php(18): yiibaseApplication->run()

5 {main}

2015-06-16 06:01:26 [192.168.1.101][-][-][info][application] $_POST = [
'_backendCSRF' => 'Ri5FeThjblJrGwsKCSwvIwF.NjNcETZldUFxKVE7WgdrH3UBdDUYGg=='
'login-form' => [
'login' => 'admin'
'password' => 'Aiar1999'
'reCaptcha' => '03AHJ_VuvAQsYGjRFRzmEwk3u2ahPVrLxj_NFvxeKlm0G8XIWH_24bhI-FQ9IWk6yoZsnpk1GbvUPh9HumUnlNW8NXiopOYFwMCpA4rmCi0-W_J8-eh7Mu9yP9_W0ylnoNcAhCEw4Fv9kuja56RAML7n2LKxnUKDfHZG3ncpIiD4QI3i74UbQOPqdF_lbt9uSqzobwARqqzCDoWxUaPhTgI0XFAJTjKzgkz71L4_E1v8UTDpRdCgZ0R-jTilPlkLjayGy-SAVXD_lRplYnqn7LVlzvFpChNc5uEt1oUBXzlqlp66dIgk3TnJBZ3OxLR-ckfHolTvKjSsFoleiVsjU7ei0eHL8rJnpHL45qcELHCEK2HHrbeUR8OxR1NzdN1ngmo5kVgFUCxpaJ41yXNa-9lI28MloQXj8vxq65-b7M4lvd-EDQv7diNxOQQ00xjUtYC4ZogkMz6EOWOjj3OQRlbCyJNBzQo3sJfg'
'rememberMe' => '0'
]
'g-recaptcha-response' => '03AHJ_VuvAQsYGjRFRzmEwk3u2ahPVrLxj_NFvxeKlm0G8XIWH_24bhI-FQ9IWk6yoZsnpk1GbvUPh9HumUnlNW8NXiopOYFwMCpA4rmCi0-W_J8-eh7Mu9yP9_W0ylnoNcAhCEw4Fv9kuja56RAML7n2LKxnUKDfHZG3ncpIiD4QI3i74UbQOPqdF_lbt9uSqzobwARqqzCDoWxUaPhTgI0XFAJTjKzgkz71L4_E1v8UTDpRdCgZ0R-jTilPlkLjayGy-SAVXD_lRplYnqn7LVlzvFpChNc5uEt1oUBXzlqlp66dIgk3TnJBZ3OxLR-ckfHolTvKjSsFoleiVsjU7ei0eHL8rJnpHL45qcELHCEK2HHrbeUR8OxR1NzdN1ngmo5kVgFUCxpaJ41yXNa-9lI28MloQXj8vxq65-b7M4lvd-EDQv7diNxOQQ00xjUtYC4ZogkMz6EOWOjj3OQRlbCyJNBzQo3sJfg'
]

$_COOKIE = [
'BACKENDSESSID' => '5rki86btckctfobj540lclva93'
]

$_SESSION = [
'__flash' => []
'__returnUrl' => '/admin'
]

$_SERVER = [
'REDIRECT_REDIRECT_STATUS' => '200'
'REDIRECT_STATUS' => '200'
'HTTP_HOST' => 'www.intracheck.tk'
'HTTP_CONNECTION' => 'keep-alive'
'CONTENT_LENGTH' => '1181'
'HTTP_CACHE_CONTROL' => 'max-age=0'
'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8'
'HTTP_ORIGIN' => 'http://www.intracheck.tk'
'HTTP_USER_AGENT' => 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36'
'CONTENT_TYPE' => 'application/x-www-form-urlencoded'
'HTTP_REFERER' => 'http://www.intracheck.tk/admin/user/security/login.html'
'HTTP_ACCEPT_ENCODING' => 'gzip, deflate'
'HTTP_ACCEPT_LANGUAGE' => 'es-ES,es;q=0.8,en;q=0.6,gl;q=0.4,und;q=0.2,ru;q=0.2'
'HTTP_COOKIE' => 'BACKENDSESSID=5rki86btckctfobj540lclva93'
'PATH' => 'C:Perl64sitebin;C:Perl64bin;C:imagemagick;C:ImageMagick;C:Windowssystem32;C:Windows;C:WindowsSystem32Wbem;C:WindowsSystem32WindowsPowerShellv1.0;C:ProgramDataComposerSetupbin;C:Php;C:phppear;C:Program FilesMicrosoft SQL Server110ToolsBinn;C:UsersTerabyte7AppDataRoamingComposervendorbin;C:Program Files (x86)Gitbin;'
'SystemRoot' => 'C:Windows'
'COMSPEC' => 'C:Windowssystem32cmd.exe'
'PATHEXT' => '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC'
'WINDIR' => 'C:Windows'
'SERVER_SIGNATURE' => ''
'SERVER_SOFTWARE' => 'Apache/2.4.12 (Win64)'
'SERVER_NAME' => 'www.intracheck.tk'
'SERVER_ADDR' => '192.168.1.101'
'SERVER_PORT' => '80'
'REMOTE_ADDR' => '192.168.1.101'
'DOCUMENT_ROOT' => 'C:/webs/intracheck'
'REQUEST_SCHEME' => 'http'
'CONTEXT_PREFIX' => ''
'CONTEXT_DOCUMENT_ROOT' => 'C:/webs/intracheck'
'SERVER_ADMIN' => 'root@localhost'
'SCRIPT_FILENAME' => 'C:/webs/intracheck/backend/web/index.php'
'REMOTE_PORT' => '49571'
'REDIRECT_URL' => '/backend/web//user/security/login.html'
'GATEWAY_INTERFACE' => 'CGI/1.1'
'SERVER_PROTOCOL' => 'HTTP/1.1'
'REQUEST_METHOD' => 'POST'
'QUERY_STRING' => ''
'REQUEST_URI' => '/admin/user/security/login.html'
'SCRIPT_NAME' => '/backend/web/index.php'
'PHP_SELF' => '/backend/web/index.php'
'REQUEST_TIME_FLOAT' => 1434450686.579
'REQUEST_TIME' => 1434450686
]
2015-06-16 06:14:47 [192.168.1.101][-][-][error][yiiwebHttpException:400] exception 'yiiwebBadRequestHttpException' with message 'Incapaz de verificar los datos enviados.' in C:websintracheckvendoryiisoftyii2webController.php:110
Stack trace:

0 C:websintracheckvendoryiisoftyii2baseController.php(149): yiiwebController->beforeAction(Object(yiibaseInlineAction))

1 C:websintracheckvendoryiisoftyii2baseModule.php(455): yiibaseController->runAction('login', Array)

2 C:websintracheckvendoryiisoftyii2webApplication.php(84): yiibaseModule->runAction('user/security/l...', Array)

3 C:websintracheckvendoryiisoftyii2baseApplication.php(375): yiiwebApplication->handleRequest(Object(yiiwebRequest))

4 C:websintracheckbackendwebindex.php(18): yiibaseApplication->run()

5 {main}

2015-06-16 06:14:47 [192.168.1.101][-][-][info][application] $_POST = [
'_backendCSRF' => 'Z2RneXotNXQoCFItPlUYAD89Jj8yX0M3HiA0NipaexUhMC4cCX5UJg=='
'login-form' => [
'login' => 'admin'
'password' => 'Aiar1999'
'reCaptcha' => '03AHJ_VuvNEZMgDq4y84T5RSR4XRWIB3wrwPSxwJEyu5E4ILysiaH3raV-SYCp0o4Gp3TpKzREcBza_sBZ-a7H-R2HpJvkw6koyXrAvgGr-vdcTcMZhdL9JwrA0hZRIdIGUPkIHsWz8mdxPtTJ-LBezy25tKMq_9SmlNrc1MVoHVp898Z3VdPeJQ7iFdULvRN1d-l7VMc2J8UKRucvD796iUUxcjJ0w5MftrrbiF0t7XWfOa0XCNlD9_0_HcGgF7BrXXHoyZo69NpLo1AFPLrKSXdjAzKZWp6fR6txb2H44M4q3EB4I3Ne4o4E2OB1cv4vqQNHwvWBE2RuCbm7UHWslYWGF_X_sSSdT058flpQjBLnBt97dsrY0vAHM0edf-n5n6jkYEpKZ_zadlv36NIJzAUe59mW0YyStWgeKTt4C0L-gXplCdMhIcA-moikU5eQyeqY-LAyXA3EvyqEOQLVY9uBJw8zW0hglg'
'rememberMe' => '0'
]
'g-recaptcha-response' => '03AHJ_VuvNEZMgDq4y84T5RSR4XRWIB3wrwPSxwJEyu5E4ILysiaH3raV-SYCp0o4Gp3TpKzREcBza_sBZ-a7H-R2HpJvkw6koyXrAvgGr-vdcTcMZhdL9JwrA0hZRIdIGUPkIHsWz8mdxPtTJ-LBezy25tKMq_9SmlNrc1MVoHVp898Z3VdPeJQ7iFdULvRN1d-l7VMc2J8UKRucvD796iUUxcjJ0w5MftrrbiF0t7XWfOa0XCNlD9_0_HcGgF7BrXXHoyZo69NpLo1AFPLrKSXdjAzKZWp6fR6txb2H44M4q3EB4I3Ne4o4E2OB1cv4vqQNHwvWBE2RuCbm7UHWslYWGF_X_sSSdT058flpQjBLnBt97dsrY0vAHM0edf-n5n6jkYEpKZ_zadlv36NIJzAUe59mW0YyStWgeKTt4C0L-gXplCdMhIcA-moikU5eQyeqY-LAyXA3EvyqEOQLVY9uBJw8zW0hglg'
]

$_COOKIE = [
'BACKENDSESSID' => '5rki86btckctfobj540lclva93'
]

$_SESSION = [
'__flash' => []
'__returnUrl' => '/admin'
]

$_SERVER = [
'REDIRECT_REDIRECT_STATUS' => '200'
'REDIRECT_STATUS' => '200'
'HTTP_HOST' => 'www.intracheck.tk'
'HTTP_CONNECTION' => 'keep-alive'
'CONTENT_LENGTH' => '1181'
'HTTP_CACHE_CONTROL' => 'max-age=0'
'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8'
'HTTP_ORIGIN' => 'http://www.intracheck.tk'
'HTTP_USER_AGENT' => 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36'
'CONTENT_TYPE' => 'application/x-www-form-urlencoded'
'HTTP_REFERER' => 'http://www.intracheck.tk/admin/login.html'
'HTTP_ACCEPT_ENCODING' => 'gzip, deflate'
'HTTP_ACCEPT_LANGUAGE' => 'es-ES,es;q=0.8,en;q=0.6,gl;q=0.4,und;q=0.2,ru;q=0.2'
'HTTP_COOKIE' => 'BACKENDSESSID=5rki86btckctfobj540lclva93'
'PATH' => 'C:Perl64sitebin;C:Perl64bin;C:imagemagick;C:ImageMagick;C:Windowssystem32;C:Windows;C:WindowsSystem32Wbem;C:WindowsSystem32WindowsPowerShellv1.0;C:ProgramDataComposerSetupbin;C:Php;C:phppear;C:Program FilesMicrosoft SQL Server110ToolsBinn;C:UsersTerabyte7AppDataRoamingComposervendorbin;C:Program Files (x86)Gitbin;'
'SystemRoot' => 'C:Windows'
'COMSPEC' => 'C:Windowssystem32cmd.exe'
'PATHEXT' => '.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC'
'WINDIR' => 'C:Windows'
'SERVER_SIGNATURE' => ''
'SERVER_SOFTWARE' => 'Apache/2.4.12 (Win64)'
'SERVER_NAME' => 'www.intracheck.tk'
'SERVER_ADDR' => '192.168.1.101'
'SERVER_PORT' => '80'
'REMOTE_ADDR' => '192.168.1.101'
'DOCUMENT_ROOT' => 'C:/webs/intracheck'
'REQUEST_SCHEME' => 'http'
'CONTEXT_PREFIX' => ''
'CONTEXT_DOCUMENT_ROOT' => 'C:/webs/intracheck'
'SERVER_ADMIN' => 'root@localhost'
'SCRIPT_FILENAME' => 'C:/webs/intracheck/backend/web/index.php'
'REMOTE_PORT' => '49660'
'REDIRECT_URL' => '/backend/web//login.html'
'GATEWAY_INTERFACE' => 'CGI/1.1'
'SERVER_PROTOCOL' => 'HTTP/1.1'
'REQUEST_METHOD' => 'POST'
'QUERY_STRING' => ''
'REQUEST_URI' => '/admin/login.html'
'SCRIPT_NAME' => '/backend/web/index.php'
'PHP_SELF' => '/backend/web/index.php'
'REQUEST_TIME_FLOAT' => 1434451487.237
'REQUEST_TIME' => 1434451487
]

tecnologiaterabyte picture tecnologiaterabyte on 16 Jun 2015

the problem is because I activated: 'enableCookieValidation' to true

    // Configuration [Request - Backend] //
    'request' => [
        // !!! insert a secret key in the following (if it is empty) - this is required by cookie validation
        'baseUrl' => '/admin',
        'enableCookieValidation' => false,
        'enableCsrfValidation' => true,
        'cookieValidationKey' => '4UAJIduNxC5zlD4S_IIRofBKFWAyUzAz',
        'csrfParam' => '_backendCSRF',
        'csrfCookie' => [
            'httpOnly' => true,
            'path' => '/admin',
        ],
    ],

If change 'enableCookieValidation' to false, it works perfectly, but if I change to true does not work, before working perfectly.

Reference: https://github.com/yiisoft/yii2/issues/8228 Problem with 'enableCookieValidation'.

tecnologiaterabyte picture tecnologiaterabyte on 16 Jun 2015
  1. Do you have only one application or there are multiple as in case of advanced app?
  2. Are you using development domain such as http://mysite?
samdark picture samdark on 16 Jun 2015

1.- Do you have only one application or there are multiple as in case of advanced app ?
R: Use Advance App.

2.- Are you using development domain such as http://mysite?
R: development domain configured from archive:

C:\Windows\System32\drivers\etc\host:
    192.168.1.101   www.intracheck.tk.
tecnologiaterabyte picture tecnologiaterabyte on 16 Jun 2015

as for my case, we use a few virtual host to test, my website is www.jenjobs.com

192.168.1.230 dev.jenjobs.local // for development purpose
192.168.1.210 www.jenjobs.stage1 // for staging before going live

this is a portion of our config file:
...
'jobseeker' => [
'identityClass' => 'appmodelsJobseeker',
'class' => 'appcomponentsJobseeker', // we have customized user component
'enableAutoLogin' => true,
'enableSession' => true,
'identityCookie' => [
'name' => '_jobseeker',
'httpOnly' => true,
],
],
...

we are not aware of this issue previously, until one of our colleague receive it...

if you visit our website, press the search button on the homepage,
you will most likely to get the error if you use google chrome, compared to firefox.

sanusi87 picture sanusi87 on 17 Jun 2015

and we also use DbSession for session management

'session' => [
'class' => 'yiiwebDbSession',
]

sanusi87 picture sanusi87 on 17 Jun 2015

this is the error log from runtime/logs of this error
2015-06-17 10:54:26 [192.168.1.167][-][-][error][yiiwebHttpException:400] exception 'yiiwebBadRequestHttpException' with message 'Unable to verify your data submission.' in /home/jenjobs/wwwroot/jenjobs_20150524_043621/vendor/yiisoft/yii2/web/Controller.php:110
Stack trace:

0 /home/jenjobs/wwwroot/jenjobs_20150524_043621/vendor/yiisoft/yii2/base/Controller.php(149): yiiwebController->beforeAction(Object(yiibaseInlineAction))

1 /home/jenjobs/wwwroot/jenjobs_20150524_043621/vendor/yiisoft/yii2/base/Module.php(455): yiibaseController->runAction('search', Array)

2 /home/jenjobs/wwwroot/jenjobs_20150524_043621/vendor/yiisoft/yii2/web/Application.php(84): yiibaseModule->runAction('job/search', Array)

3 /home/jenjobs/wwwroot/jenjobs_20150524_043621/vendor/yiisoft/yii2/base/Application.php(375): yiiwebApplication->handleRequest(Object(yiiwebRequest))

4 /home/jenjobs/wwwroot/jenjobs_20150524_043621/web/index.php(12): yiibaseApplication->run()

5 {main}

2015-06-17 10:54:26 [192.168.1.167][-][-][info][application] $_POST = [
'_csrf' => 'akFUX3FSLTQIFzUNCGRYBScePTgfF2hZJQ8lCBMTGRlYEWdsGn9Ccw=='
'PostActiveSearch' => [
'keyword' => ''
'state' => [
0 => ''
]
'salary_min' => ''
'salary_max' => ''
'jobType' => ''
]
]

$_COOKIE = [
'_csrf' => 'd1802e5b196a4bf1298503df1ed270397d2a8dccc070ad9648bec9dbad634aeaa:2:{i:0;s:5:"_csrf";i:1;s:32:"YD5zIAaboVxmGbPerJ01gfLPq5ol6i_F";}'
'PHPSESSID' => '3obmvbgephj6tkmvjc2nviahv2'
'_ga' => 'GA1.2.290892750.1433401390'
'_gat' => '1'
]

$_SESSION = [
'__flash' => []
]

$_SERVER = [
'USER' => 'apache'
'HOME' => '/usr/share/httpd'
'FCGI_ROLE' => 'RESPONDER'
'REDIRECT_UNIQUE_ID' => 'VYDhYht-03TBiE4p5kjMnAAAAIo'
'REDIRECT_STATUS' => '200'
'UNIQUE_ID' => 'VYDhYht-03TBiE4p5kjMnAAAAIo'
'HTTP_HOST' => 'www.jenjobs.stage1'
'HTTP_CONNECTION' => 'keep-alive'
'CONTENT_LENGTH' => '231'
'HTTP_CACHE_CONTROL' => 'max-age=0'
'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8'
'HTTP_ORIGIN' => 'http://www.jenjobs.stage1'
'HTTP_USER_AGENT' => 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.124 Safari/537.36'
'CONTENT_TYPE' => 'application/x-www-form-urlencoded'
'HTTP_REFERER' => 'http://www.jenjobs.stage1/site/index'
'HTTP_ACCEPT_ENCODING' => 'gzip, deflate'
'HTTP_ACCEPT_LANGUAGE' => 'en-US,en;q=0.8,id;q=0.6,ms;q=0.4'
'HTTP_COOKIE' => '_csrf=d1802e5b196a4bf1298503df1ed270397d2a8dccc070ad9648bec9dbad634aeaa%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22YD5zIAaboVxmGbPerJ01gfLPq5ol6i_F%22%3B%7D; PHPSESSID=3obmvbgephj6tkmvjc2nviahv2; _ga=GA1.2.290892750.1433401390; _gat=1'
'PATH' => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin'
'SERVER_SIGNATURE' => ''
'SERVER_SOFTWARE' => 'Apache/2.4.6 (CentOS)'
'SERVER_NAME' => 'www.jenjobs.stage1'
'SERVER_ADDR' => '192.168.1.210'
'SERVER_PORT' => '80'
'REMOTE_ADDR' => '192.168.1.167'
'DOCUMENT_ROOT' => '/home/jenjobs/wwwroot/jenjobs/web'
'REQUEST_SCHEME' => 'http'
'CONTEXT_PREFIX' => ''
'CONTEXT_DOCUMENT_ROOT' => '/home/jenjobs/wwwroot/jenjobs/web'
'SERVER_ADMIN' => '[email protected]'
'SCRIPT_FILENAME' => '/home/jenjobs/wwwroot/jenjobs/web/index.php'
'REMOTE_PORT' => '2473'
'REDIRECT_URL' => '/job/search'
'GATEWAY_INTERFACE' => 'CGI/1.1'
'SERVER_PROTOCOL' => 'HTTP/1.1'
'REQUEST_METHOD' => 'POST'
'QUERY_STRING' => ''
'REQUEST_URI' => '/job/search'
'SCRIPT_NAME' => '/index.php'
'PHP_SELF' => '/index.php'
'REQUEST_TIME_FLOAT' => 1434509666.5128
'REQUEST_TIME' => 1434509666
]

sanusi87 picture sanusi87 on 17 Jun 2015

Tried searching Chrome and FF. No error. On which domain do you have backend part of the app?

samdark picture samdark on 17 Jun 2015

My Config Backend Advanced App Session Independent (Backend y Frontend):

.htaccess root app:
    # prevent directory listings
    Options -Indexes
    IndexIgnore */*

    # follow symbolic links
    Options FollowSymlinks
    RewriteEngine on

    RewriteRule ^admin(/.+)?$ /backend/web/$1 [L,PT]
    RewriteRule ^(admin)/$ /$1 [L,R=301]
    RewriteRule ^(.+)?$ /frontend/web/$1

.htaccess App Backend:

    # if a directory or a file exists, use the request directly
    # otherwise forward the request to index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . index.php

main.php:

        // Configuration [Backend - IntraCheck] //
       'id' => 'intracheck-backend',
       'basePath' => dirname(__DIR__),
       'homeUrl' => '/admin',
       'controllerNamespace' => 'backend\controllers',
       'components' => [
           // Configuration [User - Backend] //
           'user' => [
               'enableAutoLogin' => true,
               'identityCookie' => [
                   'name' => '_backendIdentity',
                   'path' => '/admin',
                   'httpOnly' => true,
               ],
           ],
           // Configuration [Session - Backend] //
          'session' => [
          'name' => 'BACKENDSESSID',
          'cookieParams' => [
              'httpOnly' => true,
              'path' => '/admin',
           ],
        ],
        // Configuration [Request - Backend] //
        'request' => [
            // !!! insert a secret key in the following (if it is empty) - this is required by cookie validation
            'baseUrl' => '/admin',
            'enableCookieValidation' => false,
            'enableCsrfValidation' => true,
            'cookieValidationKey' => '4UAJIduNxC5zlD4S_IIRofBKFWAyUzAz',
            'csrfParam' => '_backendCSRF',
            'csrfCookie' => [
                'httpOnly' => true,
                'path' => '/admin',
            ],
        ],

If 'enableCookieValidation' => true, Error Bad Request 400, if 'enableCookieValidation' => false work fine, before work fine yii v. 2.0.5 dev, PHP 5.6.6., Apache 2.4.12.

Solved: in config session cookie param 'httpOnly' -> false and 'enableCookieValidation' => true and 'enableCsrfValidation' => true work fine, if 'httpOnly' -> true and 'enableCookieValidation' => true and 'enableCsrfValidation' => true no works,

Thks,

tecnologiaterabyte picture tecnologiaterabyte on 17 Jun 2015
👍2 ❤1

we use Yii2 2.0.1 basic app, so we dont have the backend part...
as for the job posting data, the data was entered by employer( a different component but almost identical to Jobseeker component )

we do have our own system that we use to manage the data, but that page doesnt use Yii2.

as admin, we always switching between jobseeker and employer to take a look at their data... i dont know if this is the cause.

sanusi87 picture sanusi87 on 17 Jun 2015

This one is about advanced app separation. It's now documented in the guide.

samdark picture samdark on 13 Aug 2015

'enableCsrfValidation' => false,

iManie picture iManie on 28 Mar 2019
Was this page helpful?
0 / 5 - 0 ratings

Related issues

sahifedp picture sahifedp  路  3Comments
chaintng picture chaintng  路  3Comments
Locustv2 picture Locustv2  路  3Comments
AstRonin picture AstRonin  路  3Comments
indicalabs picture indicalabs  路  3Comments