benedmunds / CodeIgniter-Ion-Auth

Simple and Lightweight Auth System for CodeIgniter
http://benedmunds.com/ion_auth/
MIT License
2.34k stars 1.14k forks source link

csrf reset_password when form inside template #656

Closed ghost closed 9 years ago

ghost commented 9 years ago

Hello,

I seem to be getting a CSRF error when submitting the reset_password form whilst using the reset_password view inside of a template.

After submission, this message appears: An Error Was Encountered

This form post did not pass our security checks.

After attempting several things, I found that when I change the loading of the view from $this->_render_page('auth/reset_password', $this->data);

to using

$this->load->library('template'); $this->template->load('default', 'auth/reset_password', $this->data);

I get the error.

The template library is provided by http://code.tutsplus.com/tutorials/an-introduction-to-views-templating-in-codeigniter--net-25648

Is it likely that as the reset_password view is within a template view that something with the template is causing the post error?

Thanks very much!

ghost commented 9 years ago

Using flashdata in combination with the template library is creating issues.. You can disable the ion_auth csrf and enable CI..?

ghost commented 9 years ago

Thank you for your response, I've not been able to disable the ion_auth csrf as of yet. I would rather leave it on for the time being as the majority of my application is working with it but may I ask exactly what triggers a post security error?

Thanks again!

ghost commented 9 years ago

After doing some reviewing of my code and removing various tags such as script, css I found that after removing an invalid css link, I no longer got a CSRF error when using a template library.

here's what I removed

            <!-- Custom styles for this template -->
            <link href="starter-template.css" rel="stylesheet">

Strange but it's working now :)

Thank you!