CodeIgniter CSRF and localhost

Question

I am currently working locally (myhostname.local) to begin a development project in CodeIgniter and am trying to do a simple login form submission and the CSRF protection is not working. I get the error:

An Error Was Encountered
The action you have requested is not allowed.

A couple of things to note:

I am using CI Reactor 2.0.2
I am running everything from a local host (myhostname.local)

My form:

<?=form_open('home/login');?>
... username/password fields in here ...
<?=form_close();>

My controller:

public function login()
{

    $this->form_validation->set_rules('email','Email','trim|required');
    $this->form_validation->set_rules('password','Password','required');

    if($this->form_validation->run() === FALSE)
    {
        ... form did not pass validation ...
    }
    else
    {
        ... form passed ...
    }

}

When I submit the form to http://myhostname.local/home/login I get the above error.

Any help on why this is happening is much appreciated.

Thanks! Sean

Does this happen every single time, or only sometimes, or only after a validation failure? Also, are you sure it's localhost only - does this work on a live server for you? — No Results Found
– No Results Found, Commented Apr 30, 2011 at 14:49
It happens every time. I have not tested it on a live server. I'll do that and let you know. — seangates
– seangates, Commented Apr 30, 2011 at 15:03
That might help, especially since the title is "CodeIgniter CSRF and localhost", it may be something to do with cookies not being set, are you able to set and read cookies? Make totally sure you see the CSRF token in the html source too, I know it sounds dumb but it's good to check the simplest things first. — No Results Found
– No Results Found, Commented Apr 30, 2011 at 15:10
Have you loaded the form validation library? just to makesure... — Karthik
– Karthik, Commented Apr 30, 2011 at 15:29
@Wesley Murch - I see cookies, and I can set cookies, but there is no cookie for the CSRF. Also, the CSRF token is in source. I've uploaded the site to a live server per your request: modernstitches.seangates.com — seangates
– seangates, Commented Apr 30, 2011 at 21:26

seangates · Accepted Answer · 2019-05-28 05:28:08Z

10

It appears that setting values in the config.php file for cookies has a big impact. Once I set these back to defaults everything started working correctly again:

$config['cookie_prefix']    = "";
$config['cookie_domain']    = "";
$config['cookie_path']    = "/";
$config['cookie_secure']    = FALSE;

edited May 28, 2019 at 5:28

answered May 1, 2011 at 2:39

seangates

1,52212 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Edgar Zagórski Over a year ago

This was the correct answer in my case (Apache 2.2.24 on MacOSX). But i took it one step further and added this if (ENVIRONMENT==='development') $config['cookie_domain']=''; right after cookie_ section in config.php this way it will work if you deploy to production/stage env.

alkoni · Accepted Answer · 2012-03-21 18:52:33Z

I have encountered a similar issue; I keep getting "The action you have requested is not allowed." error message when I am trying to submit my login form. I am working locally with a virtual linux box. It turned out that my problem had something to do with date time setup on the virtual machine. Once I update date to match my host machines date time, the problem disappears.

I am using CondeIgniter v. 2.1.0.

Here are parts of my config.php file:

$config['cookie_prefix']    = "";
$config['cookie_domain']    = "";
$config['cookie_path']      = "/";
$config['cookie_secure']    = FALSE;

$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'my_csrf_token';
$config['csrf_cookie_name'] = 'mycsrf';
$config['csrf_expire'] = 7200;

I hope this info helps someone experiencing a similar issue.

Knud Potente · Accepted Answer · 2012-03-12 11:09:53Z

Running CI 2.1.0 on a localhost setup with MAMP.

Installation of CI is brand new, with no extras. Simply following along the 'Tutorial' in the User Guide, and came across the same error after creating my first form, and enabling CSRF in the configs.

The 'form_open()' is used to open the form. The hidden field is being created. The error appears every time: "the action you have requested is not allowed".

After playing around with the cookie config options in config.php, as suggested here, I found that in my case the culprit seems to be the 'cookie_prefix' config. It must be left BLANK, otherwise it causes this error. Once it is left blank, everything works.

I hope this may prove useful to others.

Collectives™ on Stack Overflow

CodeIgniter CSRF and localhost

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related