400 error _php techniques when CSRF post data is enabled

Recently has been such a mistake, has been looking for reasons, and occasionally see a resolution of the article, to share with you to see.

The first solution is to close the CSRF

Public Function init () {
  $this->enablecsrfvalidation = false;
}

The second solution is to include hidden fields in form forms

<input name= "_csrf" type= "hidden" id= "_csrf" value= "<?= Yii:: $app->request->csrftoken?>" >

The third solution is to add the _csrf field to Ajax

var Csrftoken = $ (' meta[name= "Csrf-token"]). attr ("content");
$.ajax ({
 type: ' POST ',
 url:url,
 data: {_csrf:csrftoken},
 success:success,
 datatype:datatype
});

Yii This matching process and Yii:: $app->request->csrftoken This value store location Description:

Storage location

  protected function Createcsrfcookie ($token)
  {
    $options = $this->csrfcookie;
    $options [' name '] = $this->csrfparam;
    $options [' value '] = $token;
    return new Cookie ($options);
  

The method of the school prescription

  Public Function Validatecsrftoken ($token = null)
  {
    $method = $this->getmethod ();
    Only validate CSRF token on non-"safe" methods http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
    if (! $this->enablecsrfvalidation | | in_array ($method, [' Get ', ' head ', ' OPTIONS '], True) "{return
      true;
    }

    $trueToken = $this->loadcsrftoken ();

    if ($token!== null) {return
      $this->validatecsrftokeninternal ($token, $trueToken);
    } else {return
      $ This->validatecsrftokeninternal ($this->getbodyparam ($this->csrfparam), $trueToken)
        | | $this-> Validatecsrftokeninternal ($this->getcsrftokenfromheader (), $trueToken);
    }
  

The above mentioned is the entire content of this article, I hope you can enjoy.