如何仅在 PHP CodeIgniter 中的特定 url/页面上使用 CSRF

Question

Hi I am trying to use CodeIngiter's CSRF mechanism. But the thing is that I do not want to use it for every url/page. I only want to use it for a specific url/page.

I have the following code. I want the CSRF check only on site_url('login') and site_url('signup')

But the CSRF happens on every page. How can I make the CSRF to ignore other URLs and only focus on the 2 I've specified above ?

$config['csrf_protection'] = TRUE;
$config['csrf_token_name'] = 'csrf_checker';
$config['csrf_cookie_name'] = 'csrf_checker';
$config['csrf_expire'] = 7200;
$config['csrf_regenerate'] = TRUE;
$config['csrf_exclude_uris'] = array('home', 'about', 'licenses');

Answer 1

Selected URIs can be whitelisted from csrf protection (for example API endpoints expecting externally POSTed content). You can add these URIs by editing the 'csrf_exclude_uris' config parameter:

$config['csrf_exclude_uris'] = array('api/person/add');

Regular expressions are also supported (case-insensitive):

$config['csrf_exclude_uris'] = array(
        'api/record/[0-9]+',
        'api/title/[a-z]+'
);

ref : https://www.codeigniter.com/user_guide/libraries/security.html?highlight=csrf#cross-site-request-forgery-csrf