Question

我正在使用Ajax提交表单，我也在发送cookie，但是我仍然收到403禁止。这是我尝试发送Cookie的2种方法。

直接在Ajax中设置csrf cookie名称和值。

function onSignIn(googleUser) {
    console.log('onto the function');
    var profile = googleUser.getBasicProfile();

    var google_name = profile.getName();
    var google_image = profile.getImageUrl();
    var google_email = profile.getEmail();
    console.log('got the details');
    console.log('submitting');
    var title = $('#title').val();
    var message = $('#message').val();
    console.log(google_name);
    var csrf_test_name = $("input[name=csrf_test_name]").val();
    console.log(csrf_test_name);
    console.log(title);
    console.log(message);
    $.ajax({
        type: "POST",
        url: 'http://localhost/hbp/review/submit',
        data: {
            title,
            message,
            '<?php echo $this->security->get_csrf_token_name(); ?>' : '<?php echo $this->security->get_csrf_hash(); ?>',
            'google_name': google_name,
            'google_email': google_email,
            'google_image': google_image,
        },
        success: function () {
            alert('fuck');
        }
    });

从表单字段获取CSRF cookie

                <form id="reviewForm" method="POST">
                    <div class="control-group">
                        <div class="controls">
                            <input type="text" class="form-control"
                                   placeholder="Title" id="title" required
                                   data-validation-required-message="Please enter the review title"/>
                            <p class="help-block"></p>
                        </div>
                    </div>
                    <div class="control-group">
                        <div class="controls">
    <textarea rows="10" cols="100" class="form-control"
              placeholder="Message" id="message" required
              data-validation-required-message="Please enter your message" minlength="5"
              data-validation-minlength-message="Min 5 characters"
              maxlength="999" style="resize:none"></textarea>
                        </div>
                    </div>
                    <div id="success"></div> <!-- For success/fail messages -->
                    <br>
                    <div class="g-signin2 btn btn-default pull-right" data-onsuccess="onSignIn"></div>
                    <br/>
                </form>

    function onSignIn(googleUser) {
    console.log('onto the function');
    var profile = googleUser.getBasicProfile();

    var google_name = profile.getName();
    var google_image = profile.getImageUrl();
    var google_email = profile.getEmail();
    console.log('got the details');
    console.log('submitting');
    var title = $('#title').val();
    var message = $('#message').val();
    console.log(google_name);
    var csrf_test_name = $("input[name=csrf_test_name]").val();
    console.log(csrf_test_name);
    console.log(title);
    console.log(message);
    $.ajax({
        type: "POST",
        url: 'http://localhost/hbp/review/submit',
        data: {
            title,
            message,
            'csrf_test_name ' : 'csrf_test_name ',
            'google_name': google_name,
            'google_email': google_email,
            'google_image': google_image,
        },
        success: function () {
            alert('fuck');
        }
    });

它们似乎都不起作用，如果有帮助，这里是控制器。

public function review($google_name, $google_email, $google_image, $message, $title)
{
    $this->load->library('session');
    $csrf_token = $this->security->get_csrf_hash();
    $data = array(
        'csrf_token' => $csrf_token
    );
    if (!$google_name and $google_email and $google_image and $message and $title) {
        $this->load->library('session');
        redirect('/', $this->session->set_flashdata('review_form_error', 'Error! All yields are required!')
        );
    } else {
        echo $google_name, $google_email, $google_image, $message, $title;
        $this->review_model->set_review($google_name, $google_email, $google_image, $message, $title);
        redirect(base_url(), $this->session->set_flashdata('review_success', 'Thank you for providing us with your helpful feedback'));
    }
}

Answer 1

尝试Ajax设置

$.ajaxSetup({
    data: {
        '<?php echo $this->security->get_csrf_token_name(); ?>' : '<?php echo $this->security->get_csrf_hash(); ?>'
    }
});

Answer 2

如何解决CSRF令牌问题？

在浏览器中打开开发人员控制台
转到“网络”标签
点击提出的请求
转到“ Cookie”标签-比较请求和响应Cookie

您还可以在服务器端进行var_dump（$ _ POST）。

特定问题的评论：

'csrf_test_name ' : 'csrf_test_name ',

应该不是

'csrf_test_name ' : csrf_test_name,

尝试使用双引号：

'<?php echo $this->security->get_csrf_token_name(); ?>' : "<?php echo $this->security->get_csrf_hash(); ?>",

附加：如何以干净的方式将CI变量传递给JavaScript，从而避免PHP / JS混乱？
创建一个视图文件，并将其包含在模板的底部：

文件名= views / public / ci_config.php

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
?>
<script type="text/javascript">
  var CONFIG = {
    'base_url':                     '<?php echo base_url(); ?>',
    'csrf_expire':                  '<?php echo $this->config->item('csrf_expire'); ?>',
    'csrf_token_name':              "<?php echo $this->security->get_csrf_token_name(); ?>", // needs double quotes!
    'csrf_hash':                    "<?php echo $this->security->get_csrf_hash(); ?>" // needs double quotes!
  };
</script>

使用以下命令将其加载到父模板（例如，页脚部分）中：

<?php $this->load->view('public/ci_config'); ?>

轻松地在JS文件中的任何位置访问此数据：

var csrf_token_name = CONFIG.csrf_token_name;
var csrf_hash = CONFIG.csrf_hash ;

或者像咏叹调说的那样：

$.ajaxSetup({
    data: {
        CONFIG.csrf_token_name : CONFIG.csrf_hash 
    }
});

现在，您不必将所有JS代码放入PHP文件中。

即使Cookie传输，Codeigniter Ajax请求中也禁止403

2 个答案: