What is the form input processing order in CSRF protection form ?

[adrianmak]

I'm going to put CSRF form protection on a form.

on what position on validating CSRF during form processing after submission ?

Here are pesudo code

if form submitted
   validating input fields
   if any one of fields is invlaid, stop processing and display field error
   if input fields passed validation
        validate CSRF 
        if passed CSRF validation 
             submit form data or save to database
        if not passed CSRF vlaidation
             generate form error

anything wrong with this order ?

 

 

 

[rick]

I use this format:

If form submitted {
	if CSRF is valid {
		// process form data
	} else {
		session redirect 401
	}
}
// render form

The reason I use this order is,

First, I make sure the form was submitted. If it was not, then render the form.

Second, I validate CSRF. If it passes, then process form data. // No sense processing form data if invalid.

Lastly, if CSRF fails, I redirect to 401.

 

[adrianmak]

29 minutes ago, rick said:

I use this format:

If form submitted {
	if CSRF is valid {
		// process form data
	} else {
		session redirect 401
	}
}
// render form

The reason I use this order is,

First, I make sure the form was submitted. If it was not, then render the form.

Second, I validate CSRF. If it passes, then process form data. // No sense processing form data if invalid.

Lastly, if CSRF fails, I redirect to 401.

 

How to generate a http 401 error to the client ?

[rick]

header("Status: 401", true, 401);

 

[huseyin]

I wanted to test the CSRF Validation.

Have PW 3.0.148 running on local XAMPP.
Installed the LoginRegister Module.
While Profile edit i changed the token and/or value of token on the form.

After submit no error no exception. The edited value was accepted.

On line 895 is coded : $session->CSRF->validate(); (Which should throw the exception, but did not)
If change this line from "$session->CSRF->validate();" to "echo $session->CSRF->validate();" than i get the exception as admin errorpage (See attached) .

Can someone test the same?

[huseyin]

Any comments about this CSRF problem. (see former message) 

Can anybody reproduce this? 

[kongondo]

1 hour ago, huseyin said:

Any comments about this CSRF problem. (see former message) 

Please start a new topic and show us some code ? Your question does not seem to be related to the current thread.