CSRF Filter redirect back not working

[crustamet]

Im asking about this because i am not sure if it is a bug or i am doing something wrong with the csrf or not doing.

I have this setup. public $CSRFRegenerate = true; public $CSRFRedirect = true;

i have enabled the filter csrf to be available in the global before.

I have created this routes

    $routes->group('contact', ['namespace' => 'App\Controllers'], function($routes)
    {
        $routes->get('/', 'Front/Contact::index');
        $routes->post('add_contact', 'Front/Contact::contact');
    });

i have created this controller Contact with methods index() and contact()

    public function contact()
    {
        print_r($this->request->getPost());die();

        echo 'noice';exit;
    }

i have the project inside a folder named projects /projects/ci4 - codeigniter 4 project

and the index page /projects/ci4index with htaccess

So until now everything works perfectly, i intended this error to happen to see what it does.

I DID NOT put the CSRF token inside the form, to let codeigniter REDIRECT BACK. But when this happens with this code from the CSRF Filter

$security = Services::security();

    try
    {
        $security->CSRFVerify($request);
    }
    catch (SecurityException $e)
    {
        if (config('App')->CSRFRedirect && ! $request->isAJAX())
        {
            return redirect()->back()->with('error', $e->getMessage());
        }

        throw $e;
    }

The problem here is i get redirected back on an inexistent page. From url : projects.domain/ci4index/contact To url : projects.domain/contact

I think here it should go back to projects.domain/ci4index/contact right ?

This is a problem right ?

[crustamet]

i found the problem for some reason the value of $_SESSION['_ci_previous_url'] is projects.domain/contact

where this variable is set in the project ? oO

[lonnieezell]

This is a known bug with the url helper methods when serving the site in a sub-folder. It's being worked on but one of the cases gets a bit tricky and I'm trying to track it down.

So - yes, it's a bug. But not with CSRF, it's with the base_url() and/or site_url() helpers and how IncomingRequest interprets the original URI when in a sub-folder.

[crustamet]

Ok after you close this man please tell me in this file https://github.com/codeigniter4/CodeIgniter4/blob/develop/system/HTTP/IncomingRequest.php#L719

What exactly $parts = parse_url('http://dummy' . $_SERVER['REQUEST_URI']); want to do here ?

Because of this i was digging in and i found this problem maybe related to solve this issue trough this line ?

I was just thinking and really i have nothing to explain this. what is the reason behind the http dummy xD ?