Answers.Body: <p>the CSRF field its a hidden field not part of the form attributes.<br>
  You don't have to manually type it, craft twig comes with <code>{{ getCsrfInput() }}</code> that recreates a hidden field between the <code>&lt;form>&lt;/form></code> tags.</p>
  
  <pre><code>&lt;form method="post"&gt;
      {{ getCsrfInput() }}
      &lt;!-- ... --&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>Also, that seems to be a Javascript call if you are doing Ajax you need to add those variables to the script so the action knows about them. </p>
  
  <pre><code>&lt;script&gt;
  window.csrfTokenName = "{{ craft.config.csrfTokenName|e('js') }}";
  window.csrfTokenValue = "{{ craft.request.csrfToken|e('js') }}";
  &lt;/script&gt;
  </code></pre>
  
  <p>Usually works for me.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-30T17:04:19.623Z
Answers.Text: Related: http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes
Answers.UserDisplayName: Lindsey D
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-03-30T13:59:10.493Z
Answers.LastActivityDate: 2016-03-30T13:59:10.493Z
Answers.UserDisplayName: Xpertbot
Body: <p>I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:</p>
  
  <pre><code>    &lt;script type="text/javascript"&gt;
      var cookieTest = 'CraftCookieTest='+Math.floor(Math.random() * 1000000);
      document.cookie = cookieTest;
      var cookiesEnabled = document.cookie.search(cookieTest) != -1;
      if (cookiesEnabled)
      {
          document.cookie = cookieTest + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
  
          document.write(
              '{%- set hasLogo = (CraftEdition &gt;= CraftClient and craft.rebrand.isLogoUploaded ? true : false) -%}'+
              '&lt;form id="login-form" method="post" accept-charset="UTF-8" name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}" {% if hasLogo -%}
                      {%- set logo = craft.rebrand.logo -%}
                      {%- set padding = logo.height + 30 -%}
                      class="has-logo" style="background-image: url(\'{{ logo.url }}\'); background-size: {{ logo.width }}px {{ logo.height }}px; padding-top: {{ padding }}px; margin-top: -{{ round((353+padding)/2) }}px"
                  {%- endif %}&gt;' +
                  '{% if not hasLogo -%}&lt;h1&gt;{{ siteName }}&lt;/h1&gt;{%- endif %}'+
                  '{% set placeHolderText = (craft.config.useEmailAsUsername ? "Email"|t : "Username or Email"|t) %}' +
                  '{{ forms.textField({ id: "loginName", name: "username", placeholder: placeHolderText, value: username })|e("js") }}' +
  
                  '&lt;div id="login-fields" class="nested-fields"&gt;' +
                      '{{ forms.passwordField({ id: "password", name: "password", placeholder: "Password"|t })|e("js") }}' +
                      '&lt;a id="forgot-password"&gt;{{ "Forget your password?"|t }}&lt;/a&gt;' +
                      {% if craft.config.rememberedUserSessionDuration %}
                          '{{ forms.checkboxField({ id: "rememberMe", label: "Keep me logged in"|t })|e("js") }}' +
                      {% endif %}
                  '&lt;/div&gt;' +
  
                  '&lt;div class="buttons"&gt;' +
                      '{# &lt;div id="ssl-icon" class="disabled"&gt;&lt;div class="{{ craft.request.isSecure ? "secure" : "insecure" }} icon"&gt;&lt;/div&gt;&lt;/div&gt;#}' +
                      '&lt;input id="submit" class="btn submit disabled" type="submit" value="{{ "Login"|t }}"&gt;' +
                      '&lt;div id="spinner" class="spinner hidden"&gt;&lt;/div&gt;' +
                  '&lt;/div&gt;' +
                  '&lt;a id="poweredby" href="http://craftcms.com/" title="{{ "Powered by Craft CMS"|t }}"&gt;&lt;img src="{{ resourceUrl("images/craftcms.svg") }}" /&gt;&lt;/a&gt;'+
              '&lt;/form&gt;'
          );
  
          {% if not craft.request.isMobileBrowser(true) %}
              document.getElementById("{{ (username ? 'password' : 'loginName') }}").focus();
          {% endif %}
      }
      else
      {
          document.write(
              '&lt;div class="no-access"&gt;' +
                  '&lt;div class="pane"&gt;' +
                      '&lt;div class="pane-body"&gt;' +
                          '&lt;div class="notice"&gt;' +
                              '&lt;div class="icon"&gt;&lt;/div&gt;' +
                              '&lt;p&gt;{{ "Cookies must be enabled to access the Craft CMS control panel."|t }}&lt;br&gt;' +
                                  '&lt;a class="go nowrap" href=""&gt;{{ "See how"|t }}&lt;/a&gt;' +
                              '&lt;/p&gt;' +
                          '&lt;/div&gt;' +
                      '&lt;/div&gt;' +
                  '&lt;/div&gt;' +
              '&lt;/div&gt;'
          );
      }
  &lt;/script&gt;
  </code></pre>
  
  <p>I believe this is all correct, but not sure how this could be tested? </p>
  
  <p>Thanks</p>
  
Tags: <admin><login><csrf>
Title: CSRF admin Login
ThreadText: # CSRF admin Login
  
  (Asked by: username_0 on 2016-03-30)
  
  I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:
  
  ```
      <script type="text/javascript">
      var cookieTest = 'CraftCookieTest='+Math.floor(Math.random() * 1000000);
      document.cookie = cookieTest;
      var cookiesEnabled = document.cookie.search(cookieTest) != -1;
      if (cookiesEnabled)
      {
          document.cookie = cookieTest + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
  
          document.write(
              '{%- set hasLogo = (CraftEdition >= CraftClient and craft.rebrand.isLogoUploaded ? true : false) -%}'+
              '<form id="login-form" method="post" accept-charset="UTF-8" name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}" {% if hasLogo -%}
                      {%- set logo = craft.rebrand.logo -%}
                      {%- set padding = logo.height + 30 -%}
                      class="has-logo" style="background-image: url(\'{{ logo.url }}\'); background-size: {{ logo.width }}px {{ logo.height }}px; padding-top: {{ padding }}px; margin-top: -{{ round((353+padding)/2) }}px"
                  {%- endif %}>' +
                  '{% if not hasLogo -%}<h1>{{ siteName }}</h1>{%- endif %}'+
                  '{% set placeHolderText = (craft.config.useEmailAsUsername ? "Email"|t : "Username or Email"|t) %}' +
                  '{{ forms.textField({ id: "loginName", name: "username", placeholder: placeHolderText, value: username })|e("js") }}' +
  
                  '<div id="login-fields" class="nested-fields">' +
                      '{{ forms.passwordField({ id: "password", name: "password", placeholder: "Password"|t })|e("js") }}' +
                      '<a id="forgot-password">{{ "Forget your password?"|t }}</a>' +
                      {% if craft.config.rememberedUserSessionDuration %}
                          '{{ forms.checkboxField({ id: "rememberMe", label: "Keep me logged in"|t })|e("js") }}' +
                      {% endif %}
                  '</div>' +
  
                  '<div class="buttons">' +
                      '{# <div id="ssl-icon" class="disabled"><div class="{{ craft.request.isSecure ? "secure" : "insecure" }} icon"></div></div>#}' +
                      '<input id="submit" class="btn submit disabled" type="submit" value="{{ "Login"|t }}">' +
                      '<div id="spinner" class="spinner hidden"></div>' +
                  '</div>' +
                  '<a id="poweredby" href="http://craftcms.com/" title="{{ "Powered by Craft CMS"|t }}"><img src="{{ resourceUrl("images/craftcms.svg") }}" /></a>'+
              '</form>'
          );
  
          {% if not craft.request.isMobileBrowser(true) %}
              document.getElementById("{{ (username ? 'password' : 'loginName') }}").focus();
          {% endif %}
      }
      else
      {
          document.write(
              '<div class="no-access">' +
                  '<div class="pane">' +
                      '<div class="pane-body">' +
                          '<div class="notice">' +
                              '<div class="icon"></div>' +
                              '<p>{{ "Cookies must be enabled to access the Craft CMS control panel."|t }}<br>' +
                                  '<a class="go nowrap" href="">{{ "See how"|t }}</a>' +
                              '</p>' +
                          '</div>' +
                      '</div>' +
                  '</div>' +
              '</div>'
          );
      }
  </script>
  
  ```
  
  I believe this is all correct, but not sure how this could be tested?
  
  Thanks
  
  **Tags:** admin, login, csrf
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2016-03-30. Score: 2 | Accepted answer
  
  the CSRF field its a hidden field not part of the form attributes.  
  You don't have to manually type it, craft twig comes with `{{ getCsrfInput() }}` that recreates a hidden field between the `<form></form>` tags.
  
  ```
  <form method="post">
      {{ getCsrfInput() }}
      <!-- ... -->
  </form>
  
  ```
  
  Also, that seems to be a Javascript call if you are doing Ajax you need to add those variables to the script so the action knows about them.
  
  ```
  <script>
  window.csrfTokenName = "{{ craft.config.csrfTokenName|e('js') }}";
  window.csrfTokenValue = "{{ craft.request.csrfToken|e('js') }}";
  </script>
  
  ```
  
  Usually works for me.
  
  > **Comments:**
  > **username_2**: Related: http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes  
  
  ---
  
  