Breaking News: Grepper is joining You.com. Read the official announcement!

CodeIgniter\Shield\Exceptions\SecurityException Config\Security::$csrf Protection is set to 'cookie'. Same-site attackers may bypass the CSRF protection. Please set it to 'session'.

Santiago Galeano answered on February 4, 2023 Popularity 1/10 Helpfulness 1/10

answer CodeIgniter\Shield\Exceptions\SecurityException Config\Security::$csrf Protection is set to 'cookie'. Same-site attackers may bypass the CSRF protection. Please set it to 'session'.

CodeIgniter\Shield\Exceptions\SecurityException Config\Security::$csrf Protection is set to 'cookie'. Same-site attackers may bypass the CSRF protection. Please set it to 'session'.

Comment

<?php

namespace Config;

use CodeIgniter\Config\BaseConfig;

class Security extends BaseConfig
{
    /**
     * --------------------------------------------------------------------------
     * CSRF Protection Method
     * --------------------------------------------------------------------------
     *
     * Protection Method for Cross Site Request Forgery protection.
     *
     * @var string 'cookie' or 'session'
     */
    public string $csrfProtection = 'session';

    /**
     * --------------------------------------------------------------------------
     * CSRF Token Randomization
     * --------------------------------------------------------------------------
     *
     * Randomize the CSRF Token for added security.
     */
    public bool $tokenRandomize = false;

    /**
     * --------------------------------------------------------------------------
     * CSRF Token Name
     * --------------------------------------------------------------------------
     *
     * Token name for Cross Site Request Forgery protection.
     */
    public string $tokenName = 'csrf_test_name';

    /**
     * --------------------------------------------------------------------------
     * CSRF Header Name
     * --------------------------------------------------------------------------
     *
     * Header name for Cross Site Request Forgery protection.
     */
    public string $headerName = 'X-CSRF-TOKEN';

    /**
     * --------------------------------------------------------------------------
     * CSRF Cookie Name
     * --------------------------------------------------------------------------
     *
     * Cookie name for Cross Site Request Forgery protection.
     */
    public string $cookieName = 'csrf_cookie_name';

    /**
     * --------------------------------------------------------------------------
     * CSRF Expires
     * --------------------------------------------------------------------------
     *
     * Expiration time for Cross Site Request Forgery protection cookie.
     *
     * Defaults to two hours (in seconds).
     */
    public int $expires = 7200;

    /**
     * --------------------------------------------------------------------------
     * CSRF Regenerate
     * --------------------------------------------------------------------------
     *
     * Regenerate CSRF Token on every submission.
     */
    public bool $regenerate = true;

    /**
     * --------------------------------------------------------------------------
     * CSRF Redirect
     * --------------------------------------------------------------------------
     *
     * Redirect to previous page with error on failure.
     */
    public bool $redirect = false;

    /**
     * --------------------------------------------------------------------------
     * CSRF SameSite
     * --------------------------------------------------------------------------
     *
     * Setting for CSRF SameSite cookie token.
     *
     * Allowed values are: None - Lax - Strict - ''.
     *
     * Defaults to `Lax` as recommended in this link:
     *
     * @see https://portswigger.net/web-security/csrf/samesite-cookies
     *
     * @deprecated `Config\Cookie` $samesite property is used.
     */
    public string $samesite = 'Lax';
}

Popularity 1/10 Helpfulness 1/10 Language php

Source: Grepper

Tags: bypass php set

Link to this answer
Share Copy Link

Contributed on Feb 04 2023

Santiago Galeano

0 Answers Avg Quality 2/10

CodeIgniter\Shield\Exceptions\SecurityException Config\Security::$csrf Protection is set to 'cookie'. Same-site attackers may bypass the CSRF protection. Please set it to 'session'.

Contents

More Related Answers

CodeIgniter\Shield\Exceptions\SecurityException Config\Security::$csrf Protection is set to 'cookie'. Same-site attackers may bypass the CSRF protection. Please set it to 'session'.

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.