Craft CSRF protection and Facebook Tab

Question

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook

Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.

I don't want to disable CSRF - what could i do... plugin with a controller to render the template?

Robin Schambach · Answer

You can disable the token for a certain controller via

use Craft;
...
Yii::$app->controller->enableCsrfValidation = false;

or inside a Controller for a certain request

/**
 * @inheritdoc
 */
public function beforeAction($action)
{            
    if ($action->id == 'my-method') {
        $this->enableCsrfValidation = false;
    }

return parent::beforeAction($action);
}

Take a look at $enableCsrfValidation property of yiiwebController.

Mostafa Soufi · Answer

Try to disable the CSRF protection by event
use Yii;
use yiibaseActionEvent;
use yiibaseEvent;
use yiiwebController;

Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
    if ($actionEvent->action->id == 'facebook') {
        Yii::$app->controller->enableCsrfValidation = false;
    }
});

Craft CSRF protection and Facebook Tab

2 Answers

Add your own answers!

Ask a Question