1
vote
Accepted
Generate CSRF Token Asynchronously
You can write a currently valid CRSF token to any location you like in your template output using the Single Global Variable {csrf_token} - so one solution to your issue is to write this value into a ...
- 3,572
1
vote
Solspace Freeform return path {csrf_token}
This is likely due to parse order, where the {csrf_token} variable wouldn't be parsed yet until the {exp:freeform:form} tag has fully rendered, which would be after the parameters have been parsed.
- 6,139
1
vote
Accepted
Freeform Form expired error in Google Chrome only
ExpressionEngine 2.9.3 officially addressed and resolved some common issues with CSRF. I strongly suggest you upgrade to EE 2.9.3 or greater to resolve or rule out that issue. :)
"CSRF tokens stored ...
- 6,139
1
vote
solspace super search 'super_search_keywords' and 'csrf_token' tags not parsed
csrf_token has been introduced in EE 2.8+. See http://www.solspace.com/docs/super_search/search/#csrf_token
EE 2.7.x used XID before it was renamed to csrf_token. Therefore, you need to add an XID ...
- 6,139
1
vote
XSS vulnerability - malicious cookie value
I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report.
However I could do it on your site using the exact ...
- 7,176
Only top scored, non community-wiki answers of a minimum length are eligible