Yii中的CSRF令牌超时？

Question

My CSRF token seems to be timing out. Is there any way to prevent this?

I have a single page app where my frontend is written in AngularJS. For the most part, my CSRF token's validate fine and I can confirm that I send the token in through every request. However, occasionally I will see errors from my server saying that "The CSRF token could not be verified". I do not fully understand the internals of how the CSRF token is verified, but is there any reason for why this would be happening?

Our application is also international, but because of our server infrastructure there is slowdown in certain geographical areas. I've noticed (just ad-hoc) that if, for example, the user is uploading a file and the request takes longer than usual, the chances of the CSRF token being invalid is higher.

Would love to hear any ideas about this! Thanks in advance!

Answer 1

I think Yii is validing CSRF against cookie, try extending the CHttpRequest base class and validate against session. This leads to the varying session time out against CSRF validity.

class HttpRequest extends CHttpRequest
{
    public function getCsrfToken()
        {
            if ($this->_csrfToken === null) {
                $session = Yii::app()->session;
                $csrfToken = $session->itemAt($this->csrfTokenName);
                if ($csrfToken === null) {
                    $csrfToken = sha1(uniqid(mt_rand(), true));
                    $session->add($this->csrfTokenName, $csrfToken);
                }
                $this->_csrfToken = $csrfToken;
            }

            return $this->_csrfToken;
        }

        public function validateCsrfToken($event)
        {
            if ($this->getIsPostRequest()) {
                // only validate POST requests
                $session = Yii::app()->session;

                $headers = Common::getAllHeaders();

                if ($session->contains($this->csrfTokenName) && (isset($_POST[$this->csrfTokenName]) || isset($headers['X-Csrf-Token']))) {
                    $tokenFromSession = $session->itemAt($this->csrfTokenName);
                    $tokenFromPost = isset($_POST[$this->csrfTokenName]) ? $_POST[$this->csrfTokenName] : $headers['X-Csrf-Token'];
                    $valid = $tokenFromSession === $tokenFromPost;
                } else {
                    $valid = false;
                }
                if (!$valid) {
                    header("Location: " . Yii::app()->createAbsoluteUrl(Yii::app()->request->url));
                }
            }
        }
}

And use it as in your config file:

'request' => array(
            'enableCsrfValidation' => true,
            'class' => 'HttpRequest',

            'csrfCookie' => array(
                'httpOnly' => true,
                'secure' => true
            ),

Note: Donot copy and paste all the content. Modify as per your need. This is just a start. Hope i understand your problem.