CSRF token mismatch in post request in 3.6 version

Question

I have two different apps of cakephp. One has a version 3.5 and other 3.6.

When i used and built 3.5 app i did not have a problem of CSRF matching in post requ

Answer 1

For CakePHP 3.8, this worked for me. In config\routes.php comment the line as so :

//$routes->applyMiddleware('csrf');

Answer 2

Add this code on your $.ajax() function call:

beforeSend: function (xhr) { // Add this line
        xhr.setRequestHeader('X-CSRF-Token', $('[name="_csrfToken"]').val());
 },  // Add this line

Answer 3

The latest 3.6 application template now uses the CSRF middleware by default, see your apps src/Application.php file. Unfortunately this change hasn't been documented properly, and hit people by surprise.

Ideally you do not disable it, but instead pass the proper CSRF token alongside with your AJAX requests, you can easily obtain the token from the request object in your view templates, for example in the layout to make it globally available:

<script>
var csrfToken = <?= json_encode($this->request->getParam('_csrfToken')) ?>;
// ...
</script>

You can then easily use it in your AJAX requests:

$.ajax({
    headers: {
        'X-CSRF-Token': csrfToken
    },
    // ...
});

See also

• Cookbook > Middleware > Cross Site Request Forgery (CSRF) Middleware
• Cookbook > Middleware > CSRF Protection and AJAX Requests

Answer 4

i had the same error, without using ajax, the problem was that admin theme was not using cakephp 3 form helper sintax, it was html.

after i changed with Form->create() ?> Form->end() ?> it worked fine