使用CSRF Codeigniter和Ajax登录

Question

我将使用CSRF codeigniter和ajax进行安全登录。 但是我的语法有问题。 和$ config ['csrf_protection'] = TRUE;

这是我的形式：

<?php echo form_open('admin/info_type_user_log/log_admin',array('id' => 'form-loginx'));?>
        <div class="input-group" style="margin-bottom:10px;">
            <span class="input-group-addon lab"><span class="glyphicon glyphicon-user"></span></span>
            <input type="text" name="username" id="username" class="form-control inp usernamex" placeholder="username" required>
        </div>
        <div class="input-group" style="margin-bottom:10px;">
            <span class="input-group-addon lab"><span class="glyphicon glyphicon-lock"></span></span>
            <input type="password" name="password" id="password" class="form-control inp passwordx" placeholder="password" required>
        </div>
        <button type="submit" name="submit" class="submit_login btn btn-md btn-primary">Login</button>
        <label><input type="checkbox" class="lihat"> lihat password</label>
        <?php echo form_close();?>

这是我的javascript：

$('#form-loginx').submit(function(e){ // Create `click` event function for login
        e.preventDefault();
        var csrfName = '<?php echo $this->security->get_csrf_token_name(); ?>',
            csrfHash = '<?php echo $this->security->get_csrf_hash(); ?>';
        var me = $(this);
        $('.submit_login').html('Loading ...'); //Loading button text 

        $.ajax({ // Send the credential values to another checker.php using Ajax in POST menthod
            url  : me.attr('action'),
            type : 'POST',
            data : {csrfName:csrfHash,me.serialize},
            dataType : 'json',
        success: function(response){ // Get the result and asign to each cases
            $('.submit_login').html('Login'); //Loading button text 
            if(response == true){
                $(".alert-sukses").html("Sedang mengarahkan..").slideToggle("fast").delay(3000).slideToggle("fast");
                window.location.href = 'admin/info_type_user_log';
            }else {
                gagal();
            }
        }
        });
    });

和我的控制器：

function log_admin(){       
    $reponse = array('success' => true);
    $user = $this->security->xss_clean($this->input->post('username'));
    $pass = $this->security->xss_clean($this->input->post('password'));

     $reponse = array(
            'csrfName' => $this->security->get_csrf_token_name(),
            'csrfHash' => $this->security->get_csrf_hash()
            );

    $cek = $this->model_admst->valid_log($user, md5($pass));

    if($cek->num_rows() > 0){

        foreach($cek->result() as $data){
            $sess_data['id']            = $data->id;
            $sess_data['nama_depan']    = $data->nama_depan;
            $sess_data['nama_belakang'] = $data->nama_belakang;
            $sess_data['email']         = $data->email;
            $sess_data['username']      = $data->username;
            $sess_data['gb_user']       = $data->gb_user;
            $sess_data['last_login']    = $data->last_login;
            $sess_data['log_access']    = "TRUE_OK_1";

            $this->session->set_userdata($sess_data);
            $this->model_admst->updateLastlogin($data->id);
            log_helper("login", "akses login sukses");
        }

        $reponse['success'] = true;
    }else{
        $reponse['success'] = false;
    }
    echo json_encode($reponse);
 }

我的模型是：

function valid_log($user,$pass){
    $this->db->where('username', $user);
    $this->db->where('password', $pass);
    $this->db->where('status', 'aktif');
    $this->db->where('level', 'admjosslog21');
    $this->db->where('akses', '1');
    return $this->db->get('user');
}

Answer 1

在ajax中传递token name和hash key ，然后通过控制器中的post获得它

  data : {csrfName:csrfName,csrfHash:csrfHash,me.serialize},

在控制器中

 $reponse = array(
        'csrfName' => $this->input->post('csrfName'),
        'csrfHash' => $this->input->post('csrfHash')
        );

Answer 2

试试这个代码

$("#state1").change(function () {
            $.ajax({
                url: "<?php echo base_url('admin/get_districtsfromstates'); ?>",
                type: "POST",
                data: {id: $(this).val(),'<?php echo $this->security->get_csrf_token_name(); ?>': '<?php echo $this->security->get_csrf_hash(); ?>'},
                success: function (data)
                {
                    $("#district1").html(data);
                }
            });
        });

Answer 3

Javascript中的PHP是一个丑陋的解决方案，只需将脚本列入白名单，如下所示：

$config['csrf_exclude_uris'] = array(
'admin/log_admin', '...', '...',
);