Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

2 votes

Load XML via jquery.ajax causes an error

I checked and I can see the XID param being sent to the jquery.ajax by looking in chrome network panel, i can see the query string it builds. So we are good there. It sounds like you are sending the ...
user avatar
  • 2,255
1 vote
Accepted

Generate CSRF Token Asynchronously

You can write a currently valid CRSF token to any location you like in your template output using the Single Global Variable {csrf_token} - so one solution to your issue is to write this value into a ...
user avatar
  • 3,562
1 vote

Solspace Freeform return path {csrf_token}

This is likely due to parse order, where the {csrf_token} variable wouldn't be parsed yet until the {exp:freeform:form} tag has fully rendered, which would be after the parameters have been parsed.
user avatar
  • 6,139
1 vote
Accepted

Freeform Form expired error in Google Chrome only

ExpressionEngine 2.9.3 officially addressed and resolved some common issues with CSRF. I strongly suggest you upgrade to EE 2.9.3 or greater to resolve or rule out that issue. :) "CSRF tokens stored ...
user avatar
  • 6,139
1 vote

solspace super search 'super_search_keywords' and 'csrf_token' tags not parsed

csrf_token has been introduced in EE 2.8+. See http://www.solspace.com/docs/super_search/search/#csrf_token EE 2.7.x used XID before it was renamed to csrf_token. Therefore, you need to add an XID ...
user avatar
  • 6,139
1 vote

XSS vulnerability - malicious cookie value

I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report. However I could do it on your site using the exact ...
user avatar
  • 7,176

Only top scored, non community-wiki answers of a minimum length are eligible