Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ajax form submission removing CSRF token on submit, and adding it back in after. #156

Open
CassadyCampos opened this issue May 10, 2023 · 0 comments

Comments

@CassadyCampos
Copy link

CassadyCampos commented May 10, 2023

Describe the bug
I am submitting a form POST request via jquery on('submit').
What I've noticed is that it's being intercepted, it's removing the CSRF token, executing my ajax call then adding the CSRF token back.

I'm trying to understand why it would remove it and then execute the POST req.

The block of code seems to be this:
/**
* Add wrapper for HTMLFormElements addEventListener so that any further
* addEventListens won't have trouble with CSRF token
* todo - check for method
*/
HTMLFormElement.prototype.addEventListener_ = HTMLFormElement.prototype.addEventListener;
HTMLFormElement.prototype.addEventListener = function(eventType, fun, bubble) {
if (eventType === 'submit') {
var wrapped = CSRFP.csrfpWrap(fun, this);
this.addEventListener
(eventType, wrapped, bubble);
} else {
this.addEventListener_(eventType, fun, bubble);
}
};
csrfpWrap is removing the CSRF token from my form request, executing it and then adding my CSRF token back after it starts the request.

Additional context

  • PHP Version (example: php 8.026)
  • Framework, if applicable - Jquery AJAX
  • Browser - Chrome
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant