yii Csrf令牌cookie，为什么转移到帖子？

Question

Bad English:

Maybe I misunderstood how the Csrf, but why should it pass in the POST request, if it is in a cookie and can be taken from there.

If it is not safe, why not? Why then it it the cookie is transmitted?

Answer 1

Yii将创建一个带有CSRF令牌的cookie，每当提交表单时，它都会将cookie中的CSRF令牌与from中的CSRF令牌进行比较。