0

We are building a 'kiosk' interface into a site powered by EE (2.8.1) which makes various POST requests to other site templates as part of the flow.

The problem we are having is that because the kiosk needs to be always on, the csrf_token which is used to authenticate the POST requests is expiring (after 1 hour currently) and so said requests return a 403 (permission denied).

I had thought that there might be some way to refresh the csrf_token, but from a bit of research, it seems that these are intrinsically tied to the session's id (something along those lines anyway!), and so the same one is always returned if I post for a refreshed token.

Is there a way that I am missing that would enable us to keep making POST requests to other site templates and keep CSRF protection enabled?

Improve this question

2 Answers 2

Reset to default
0

some links that might help:

Debugging Form Expiration

Manage Session Length

Re the latter link, there are quite a few other addons for session managment on devot-ee

EDIT: Hi Mike, depends on where you do that. My experience is that the csrf token code as prescribed by EE documents works fine with forms but when it comes to javascript/ajax, apparently XID is still the way to go. One of my addons uses the XID method successfully in EE2.11.3. If you are using jquery, our ajax code shouldlook something like this

$.ajax({ url : EE.BASE + "url-to-your-php-code", type : "post", data : { "whatever-name" : whatever-value, "XID": EE.XID },... etc. etc.

And "XID": CSRF_TOKEN

also works - I just tested it.

Give that a try and see how you go?

Improve this answer
8
  • Thanks for the links John, but unfortunately they don't really answer the question. Re the expiration debugging, I don't really need to debug the expiration as I know why it is expiring. Re the session length, although technically I could set a very very long session length, I don't think this would be great practice in terms of security, and also, the kiosk needs to be always on, so could be over a year for example.
    – Mike Vaux
    Dec 7, 2016 at 10:22
  • Mike - Maybe if you explained your application a bit more? Sessions are related to logins. If no login, you could serve pages as long and as often as you like. It would help to know how logins are handled in your application or, alternatively, what triggers your post data. Usually, that would be a form. The only ways I know of submitting forms without having a logged-in user are by using the channel form with the "allowing guests to post entries" option or by writing your own addon. Let's take it from there, and I will try to help.
    – John de Beer
    Dec 7, 2016 at 15:00
  • Thanks John. Basically, for security and to avoid misuse, the kiosk is only available to logged in admins (if you try to visit the page whilst not logged in you will just be presented with a log in form). The post requests are triggered by the user clicking on something like a profile, or by them submitting a search form, whereby the responses are retrieved by ajax. Hope that helps?
    – Mike Vaux
    Dec 8, 2016 at 17:15
  • Hi Mike - don't understand why the session does not expire when your admins log out or are timed out. Are you saying that after an hour, your admins are not presented with a new login form before they can go on? - thats what I would expect. Also, do you renew your XID with each ajax request?
    – John de Beer
    Dec 8, 2016 at 21:42
  • Hi John - the session will be expiring, but because the page is never reloaded (it all happens by ajax), the log in form is never re-presented. If I'm understanding this correctly, I don't renew the XID because it is using ExpressionEngine 2.8.x, which uses csrf tokens rather than XID hashes.
    – Mike Vaux
    Dec 9, 2016 at 9:19
0

why not just add a meta refresh every 30 minutes or something

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.