Setting View::$autoRegisterCsrf to false has no effect

[cebe]

What steps will reproduce the problem?

Add the following to the config:

        'view' => [
            'autoRegisterCsrf' => false,
        ],

What is the expected result?

No csrf cookie should be generated on pages that do not contain forms.

What do you get instead?

_csrf cookie is generated on each page request if it does not exist.

Would be okay if there wasn't a law that requires to inform users when cookies are set :)

Why does this happen

luya\web\View is extended by some classes (e.g. luya\cms\base\PhpBlockView) that represent view contexts that do not represent the site-wide view context. Because $autoRegisterCsrf = true; by default these subclasses will enforce the CSRF cookie generation.

Additional infos

Q	A
LUYA Version	1.0.7
PHP Version	7.0.3
Platform	Apache
Operating system	Debian GNU/Linux

[cebe]

Possible options to fix it:

• set $autoRegisterCsrf = false by default and make the default config make it true
• overwrite $autoRegisterCsrf to false in all subclasses

[cebe]

Workaround: Add the following to the config:

    'container' => [
        'definitions' => [
            'luya\cms\base\PhpBlockView' => [
                'autoRegisterCsrf' => false,
            ],
        ],
    ],

[cebe]

hm... setting autoRegisterCsrf to false globally seems to disable admin interface, so I needed to add the following to the admin module config:

            'on beforeAction' => function() {
                Yii::$app->view->autoRegisterCsrf = true;
            },

[nadar]

Will check all your inputs asap.

[cebe]

no need to hurry with this one, I got a workaround :)

[nadar]

1. in the admin we can force this behavior in the login controller form view, so autoRegisterCsrf is not needed there anymore.
2. PhpBlockView autoRegisterCsrf should take property from global view as its not used anyhow, as csrf tags are registered in the global view object.

[nadar]

Should be fixed and your now able to disable the csrf auto registration as its intended to be:

'view' => [
    'class' => 'luya\web\View',
    'autoRegisterCsrf' => false,
],

Thanks for reporting