Answers.Body: <p>Try to disable the CSRF protection by event</p>
  <pre><code>use Yii;
  use yii\base\ActionEvent;
  use yii\base\Event;
  use yii\web\Controller;
  
  Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
      if ($actionEvent-&gt;action-&gt;id == 'facebook') {
          Yii::$app-&gt;controller-&gt;enableCsrfValidation = false;
      }
  });
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-05-25T08:29:13.997Z
Answers.LastActivityDate: 2021-05-25T08:29:13.997Z
Answers.UserDisplayName: Mostafa Soufi
Answers.Body: <p>You can disable the token for a certain controller via </p>
  
  <pre class="lang-php prettyprint-override"><code>use Craft;
  ...
  Yii::$app-&gt;controller-&gt;enableCsrfValidation = false;
  </code></pre>
  
  <p>or inside a Controller for a certain request</p>
  
  <pre class="lang-php prettyprint-override"><code>/**
   * @inheritdoc
   */
  public function beforeAction($action)
  {            
      if ($action-&gt;id == 'my-method') {
          $this-&gt;enableCsrfValidation = false;
      }
  
      return parent::beforeAction($action);
  }
  </code></pre>
  
  <p>Take a look at <a href="http://www.yiiframework.com/doc-2.0/yii-web-controller.html#$enableCsrfValidation-detail" rel="nofollow noreferrer">$enableCsrfValidation</a> property of <a href="http://www.yiiframework.com/doc-2.0/yii-web-controller.html" rel="nofollow noreferrer">yii\web\Controller</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-08-28T16:15:34.407Z
Answers.LastActivityDate: 2018-08-28T16:15:34.407Z
Answers.UserDisplayName: Robin Schambach
Body: <p>I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook</p>
  
  <p>Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.</p>
  
  <p>I don't want to disable CSRF - what could i do... plugin with a controller to render the template?</p>
  
Tags: <csrf><post>
Title: Craft CSRF protection and Facebook Tab
ThreadText: # Craft CSRF protection and Facebook Tab
  
  (Asked by: username_0 on 2018-08-28)
  
  I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook
  
  Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.
  
  I don't want to disable CSRF - what could i do... plugin with a controller to render the template?
  
  **Tags:** csrf, post
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2021-05-25. Score: 1
  
  Try to disable the CSRF protection by event
  
  ```
  use Yii;
  use yii\base\ActionEvent;
  use yii\base\Event;
  use yii\web\Controller;
  
  Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
      if ($actionEvent->action->id == 'facebook') {
          Yii::$app->controller->enableCsrfValidation = false;
      }
  });
  
  ```
  
  
  ---
  
  ### Answer by username_2 on 2018-08-28. Score: 1
  
  You can disable the token for a certain controller via
  
  ```php
  use Craft;
  ...
  Yii::$app->controller->enableCsrfValidation = false;
  
  ```
  
  or inside a Controller for a certain request
  
  ```php
  /**
   * @inheritdoc
   */
  public function beforeAction($action)
  {            
      if ($action->id == 'my-method') {
          $this->enableCsrfValidation = false;
      }
  
      return parent::beforeAction($action);
  }
  
  ```
  
  Take a look at [$enableCsrfValidation](http://www.yiiframework.com/doc-2.0/yii-web-controller.html#$enableCsrfValidation-detail) property of [yii\web\Controller](http://www.yiiframework.com/doc-2.0/yii-web-controller.html).
  
  
  ---
  
  