Not getting result from php in ajax codeigniter.?

Question

Here is my little code of ajax and php, Which I want pass and get for login system.

Here I have ajax code.

 <script>
    $("input#login_btn").on('click',function(e){
        e.preventDefault();

            var x = document.forms["loginform"]["login_username"].value;
            var x1 = document.forms["loginform"]["login_password"].value;
            var y = document.getElementById('login-error');
            var z = document.getElementById('password-error');

            if (x == "") { y.style.display ='block'; }else{ y.style.display ='none'; }
            if (x1 == "") { z.style.display ='block'; }else{ z.style.display ='none'; } 

                var d = document.forms["loginform"]["login_username"].value;
                var d1 = document.forms["loginform"]["login_password"].value;                       

            if(d != '' && d1 != ''){
                $.ajax({
                   url:"<?php echo base_url(); ?>Auth",
                   type: "POST",
                   data:{login_username: $('input#login_username').val(), login_password: $('input#login_password').val()},

                   success : function(data){                                                    
                        if(data.success == "true"){
                            var url = $('#current_loginurl').val();                 
                            window.location.href=url;                       
                        }else{
                            $('#loginform')[0].reset();
                            $("#login_fail").show('fast');
                        }
                   },
                   error : function(data){                      
                        $('#loginform')[0].reset();
                        $("#login_fail").show('fast');
                   }

                });
            }   
        });
</script>

And here is my PHP code in codeigniter. I am using myslqi in codeigniter.

public function index(){
            require_once('connect.php');

                $url =  $this->input->post('current_loginurl');
                $username =  $this->input->post('login_username');
                $password =  $this->input->post('login_password');              

                $qry = mysqli_query($con ,"select * from `user_profile` where E_Id = '".$username."'") or die(mysqli_error($con));                  
                $row = mysqli_fetch_array($qry);
                $data = mysqli_num_rows($qry);

                if(!empty($data) && $data >0){

                    $session = array(
                            'client_username' => $row['F_Name']." ".$row['L_Name']
                              );


                    $this->session->set_userdata($session);
                    $datas = array(
                        'success' => true
                    );                  
                    echo json_encode($datas);
                    //redirect($url);
                    return true;

                }else{
                    $datas = array(
                        'success' => false
                    );                  
                    echo json_encode($datas);
                    return false;
                }                   

        }   

I did lost of alter in this code but can't get success. any one can help where am I wrong. How can I get return result in ajax.

Answer 1

When CSRF is enabled we need to submit it with the post data:

data: {
      csrf_token_name: CONFIG.csrf_cookie_name
}

CONFIG is created in a CI view file (.php) and loaded in with your controller or templating system:

<script type="text/javascript">
var CONFIG = {
            'base_url': '<?php echo base_url(); ?>',
            'csrf_token_name' : "<?php echo $this->security->get_csrf_token_name(); ?>",
            'csrf_cookie_name' : "<?php echo $this->security->get_csrf_hash(); ?>"
        }
</script>

REMARK: when CSRF regeneration is on (config.php) the second time you make the call it will give an error 403 (check the network tab in your browser console). Either turn off CSRF regeneration for the whole application https://security.stackexchange.com/questions/22903/why-refresh-csrf-token-per-form-request

or do it for just those methods you use for ajax by adding this in the CSRF section in config.php around line 435 (below $config['csrf_regenerate'] = TRUE; ):

$no_regen = array(
    '(HMVC-module/)controller/method'
);

if (isset($_SERVER["REQUEST_URI"])) {
    foreach ($no_regen as $csrf_page){
        if(stripos($_SERVER["REQUEST_URI"], $csrf_page) !== FALSE) {
            $config['csrf_regenerate'] = false;
            break;
        }
    }
}

Bonus remark: please validate your POST data.