Question

I need to log in to a system using curl commands but I don’t know how to skip CSRF authentication.

I tried the following but it didn’t work:

curl -d "form_username_input_name=username&form_passowrd_input_name=password" url

How do I achieve what I want?

Answer 1

I think you need to create a separate login dedicated to the cURL login. You won’t be able to by pass the CSRF protection (in fact this is why it was made).

So,

• extends the default sfGuardAuth module in your app
• create a new action called (for example) executeLoginCurl
• perform the veririfcation using the default sfGuard validator sfGuardValidatorUser
• then call $this->getUser()->signIn(...) to sign in the user

I recommend you to use a protection to avoid other application to cURL this module/action and try to brute force the login. You can, for example, make a restriction for this action on IP.