Doubt about post request

alexandreccarmo · April 19, 2015, 5:01am

Hello friends.

Yii2 accept post request of another app? For exemplo I have a app created on yii2, on this app has a controller that generate a json, so I have another app on java, this app need the json that Yii2 controller generate, so I send a request but I receive a Bad Request (#400). Why? How can i fix this?

If I call direct link test:

http://admapps-apps.getup.io/adm_mobile/web/usermobile/add

The json is showed on browser, but when I use this link on java to receive json I receive the error 400.

samdark · April 19, 2015, 6:00pm

Yes but in this case you have to turn off CSRF-validation for that concrete action.

alexandreccarmo · April 19, 2015, 6:50pm

Thanks for help

I put this code on my controller:

public $enableCsrfValidation = false;

And turn off csrf, but all actions are turn off, What Can i do to turn off a individual actions? Is it possible?

samdark · April 20, 2015, 8:02am

github.com

samdark/yii2-cookbook/blob/master/book/incoming-post.md

Handling incoming third party POST requests
===========================================

By default Yii uses CSRF protection that verifies that POST requests could be made only by the same application.
It enhances overall security significantly but there are cases when CSRF should be disabled i.e. when you expect
incoming POST requests from a third party service.

Additionally, if third party is posting via XMLHttpRequest (browser AJAX), we need to send additional headers to allow CORS ([cross-origin resource sharing](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing)).

How to do it
------------

First of all, never disable CSRF protection altogether. If you need it to be disabled, do it for specific controller or even
controller action.

### Disabling CSRF for a specific controller

Disabling protection for specific controller is easy:

```php

This file has been truncated. show original

alexandreccarmo · April 20, 2015, 1:44pm

Thanks