Skip to content

Instantly share code, notes, and snippets.

@lmarquine
Forked from ananth-iyer/CsrfValidatorSkip.php
Created April 14, 2020 17:40
Show Gist options
  • Save lmarquine/50ecb51a3dae7371fab802d1ab4152c3 to your computer and use it in GitHub Desktop.
Save lmarquine/50ecb51a3dae7371fab802d1ab4152c3 to your computer and use it in GitHub Desktop.
Magento 2.3.0: Implement below code to skip the CSRF check on your custom route called outside Magento environment. This implementation does not break core frontend/adminhtml routes, Magento 2.3/2.2/2.1 web stores.
<?php
namespace Module\Vendor\Plugin;
class CsrfValidatorSkip
{
/**
* @param \Magento\Framework\App\Request\CsrfValidator $subject
* @param \Closure $proceed
* @param \Magento\Framework\App\RequestInterface $request
* @param \Magento\Framework\App\ActionInterface $action
*/
public function aroundValidate(
$subject,
\Closure $proceed,
$request,
$action
) {
if ($request->getModuleName() == 'Your_Module_frontName_Here') {
return; // Skip CSRF check
}
$proceed($request, $action); // Proceed Magento 2 core functionalities
}
}
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
<type name="Magento\Framework\App\Request\CsrfValidator">
<plugin name="csrf_validator_skip" type="Module\Vendor\Plugin\CsrfValidatorSkip" />
</type>
</config>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment