Question

I am trying to implement CSRF validation in yii . I have written my own class and everything works fine except the fact that my post variable(for the form) does not consist of the token . Am I supposed to set the token myself in the post variable ? Yii documentation states that the post variable is set by a hidden field in every form . Does it require further implementation in the forms as well ? I know the token is not there as I saw the Post variables by dumping them .

Answer 1

I guess everything you need is enable CSRF validation in your config and use CHtml for forms (Yii Guide). Here what you need in config:

'components'=>array(
    'request'=>array(
        'enableCsrfValidation'=>true,
    ),
),