Codeigniter CSRF question

Question

I'm just wondering of there is any option where i can turn off CSRF in a specific controller/method. I've got another site that pings my site, but getting blocked because of the CSRF.

Is there any way i can get around this?

You can consider to generally disable CI CSRF "protection" because it's broken. Instead know what you do and provide sanity checks on your own to be on the safe side (which you need to do anyway for the controllers in question). — hakre
– hakre, Commented Sep 22, 2011 at 0:08

zgosalvez · Accepted Answer · 2011-11-22 10:29:16Z

7

Create a pre_system hook then put the following code inside your hook controller:

if(stripos($_SERVER["REQUEST_URI"],'/controller/function') !== FALSE)
{
    $CFG =& load_class('Config', 'core');
    $CFG->set_item('csrf_protection', FALSE);
}

Reference: http://codeigniter.com/forums/viewreply/869900/

answered Nov 22, 2011 at 10:29

zgosalvez

3841 gold badge5 silver badges22 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

twistedpixel Over a year ago

I hate to bump this but I just wanted to say that while this works, it isn't all that safe and people should be aware. For example, if your controller is api and function is dosomething you have "www.site.com/api/dosomething" disabled. But what's to stop someone going to "www.site.com/account/killkitten/api/dosomething"? CSRF disabled. Kitten killed. No?

Collectives™ on Stack Overflow

Codeigniter CSRF question

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related