How does CSRF work in yii2?

Question

Yii

How does CSRF work in yii2?
Most interested in how the token is verified

Answer 1

Isn't it in the source code?

Answer 2

And look into the source code and see for yourself - how everything is done there? There is nothing complicated there.

Answer 3

Hello! in yii2 it is not necessary to check the token, it will check it itself

if (!$this->enableCsrfValidation || in_array($method, ['GET', 'HEAD', 'OPTIONS'], true)) {
    return true;
}

Answer 4

I have a problem that the token that the form passes is not the same as in the meta tag, and a 400 error occurs

Answer 5

"Shit" works. The doc doesn't say anything about it. In principle, there is not much written about it.
I can't tell you how it works, but I can show you how it works.

<?php

/** @var $this yii\web\View */

$this->registerMetaTag(['name' => 'csrf-param', 'content' => Yii::$app->request->csrfParam]);
$this->registerMetaTag(['name' => 'csrf-token', 'content' => Yii::$app->request->getCsrfToken()]);

?>

<form action="#" method="posts">

    <!-- inputs -->

   <input type="hidden" name="<?= Yii::$app->request->csrfParam ?>" value="<?= Yii::$app->request->getCsrfToken() ?>"/>

    <!-- submit -->

</form>

Answer 6

I had it.
Server restart