Question

I have a little issue concerning CSRF security and a login form. The form works as follows:

In the main layout a view helper creates a login form and will later also display a user specific menu when a user has been authenticated.

    // User menu viewhelper
public function authentication()
{
    // Check if user is authenticated or not
    $auth = Zend_Auth::getInstance();

    if(!$auth->hasIdentity())
    {
        $form = new Application_Form_Login();
        $form->setAction($this->_view->url(array('action' => 'login'), 'ucp', true));

        return $form;
    }
    else
    {
        // return user specific menu
    }
}

The form posts to a UcpController containing all the user control panel logic, such as logging in/out and displaying user specific information.

    // loginAction in UcpController
public function loginAction()
{
    if(Zend_Auth::getInstance()->hasIdentity())
    {
        $this->_redirect('/');
        return;
    }

    $request = $this->getRequest();

    $form = new Application_Form_Login();

    if($request->isPost())
    {
        if($form->isValid($post = $request->getPost()))
        {
            // Do authentication stuff here.
        }
    }

    $this->view->form = $form;
}

Sadly this way the CSRF token fails to match and I’m clueless how to solve this problem. Am I missing something here? Should I remove the CSRF validation all together?

// The CSRF protection element as added to the login form
$this->addElement('hash', 'csrf',
    array(
        'ignore' => true
    )
);

Thanks in advance, your help is greatly appreciated 🙂

Answer 1

Problem solved! I ran into someone who encountered the same problem. The cause is very strange: http://tinyurl.com/3fkg8bk (ZF Forums).

As it turned with me, my favicon was returning an HTTP 500 code as the file was non-existent. This apparently triggers a new CSRF to be generated. I don’t have the slightest clue why, but it solved my problem to create an icon and upload it to the webroot.

Thanks for thinking along with me at least!