Cakephp get details about security component error

cakephp, security

Solution

All you have to do is look in the right place

Check your `app/tmp/logs/error.log` file

If you look in the error log you'll see an entry like this:

2013-03-16 17:24:29 Error: [BadRequestException] The request has been black-holed
#0 root/lib/Cake/Controller/Component/SecurityComponent.php(228): SecurityComponent->blackHole(Object(FacebookUsersController), 'csrf')
#1 [internal function]: SecurityComponent->startup(Object(FacebookUsersController))
#2 root/lib/Cake/Utility/ObjectCollection.php(130): call_user_func_array(Array, Array)
#3 [internal function]: ObjectCollection->trigger(Object(CakeEvent))
#4 root/lib/Cake/Event/CakeEventManager.php(246): call_user_func(Array, Object(CakeEvent))
#5 root/lib/Cake/Controller/Controller.php(670): CakeEventManager->dispatch(Object(CakeEvent))
#6 root/lib/Cake/Routing/Dispatcher.php(183): Controller->startupProcess()
#7 root/lib/Cake/Routing/Dispatcher.php(161): Dispatcher->_invoke(Object(FacebookUsersController), Object(CakeRequest), Object(CakeResponse))
#8 root/app/webroot/index.php(96): Dispatcher->dispatch(Object(CakeRequest), Object(CakeResponse))
#9 {main}

Read the error that is on screen

If you are in debug mode, this error is also shown on screen when the error happens. e.g.:

The request has been black-holed
Error: The requested address '/admin/fooby/edit/1' was not found on this server.

Stack Trace
CORE/Cake/Controller/Component/SecurityComponent.php line 228 → SecurityComponent->blackHole(FacebookUsersController, string)
[internal function] → SecurityComponent->startup(FacebookUsersController)
CORE/Cake/Utility/ObjectCollection.php line 130 → call_user_func_array(array, array)
[internal function] → ObjectCollection->trigger(CakeEvent)
CORE/Cake/Event/CakeEventManager.php line 246 → call_user_func(array, CakeEvent)
CORE/Cake/Controller/Controller.php line 670 → CakeEventManager->dispatch(CakeEvent)
CORE/Cake/Routing/Dispatcher.php line 183 → Controller->startupProcess()
CORE/Cake/Routing/Dispatcher.php line 161 → Dispatcher->_invoke(FacebookUsersController, CakeRequest, CakeResponse)
APP/webroot/index.php line 96 → Dispatcher->dispatch(CakeRequest, CakeResponse)

Handling csrf errors

With the details of a specific error (i.e. the data you are posting, and the exact token data in your session at the time) it would be possible to answer what problem brought you here, in the absense of that:

look at the line throwing the error.

In the stack trace above, the error is coming from `CORE/Cake/Controller/Component/SecurityComponent.php line 228` - Open the file and look what that code is:

if ($isPost && $isNotRequestAction && $this->csrfCheck) {
    if ($this->_validateCsrf($controller) === false) {
        return $this->blackHole($controller, 'csrf');
    }   
}

What should be obvious from this is that the function `_validateCsrf` is responsible for the request being blackholed. This should not really be much of a surprise.

Look at the source of that function:

protected function _validateCsrf(Controller $controller) {
    $token = $this->Session->read('_Token');
    $requestToken = $controller->request->data('_Token.key');
    if (isset($token['csrfTokens'][$requestToken]) && $token['csrfTokens'][$requestToken] >= time()) {
        if ($this->csrfUseOnce) {
            $this->Session->delete('_Token.csrfTokens.' . $requestToken);
        }
        return true;
    }
    return false;
}

Depending on why that function returns false, determines how you continue to debug.

Correct configuration of the component

The inevitable consequence of debugging a CSRF error is you'll need to modify the configuration of the Security component.

Do you, for example, want to be reusing tokens, because your app is submitting the same form multiple times between page loads?

Are you self-invalidating the form requests by adding new fields to the form data - You can use the unlockedFields property to exclude these fields from the csrf checks.

You can also simply disable CSRF checks completey. That has obvious security consequences - but if you're struggling to work with the component, it's an easy way to work around and problems you currently face.

Problem

I am using security component in my projects and is there any way to get the detailed description about the error while developing ? For ex:- if any field is added in view without using cakephp's form method, it is returning error as 'auth' in my blackHoleCallback function. Instead I need beacuse of what reason it returned that error. Because it is taking so much time to rectify the problem. Is there any way to get the detailed error description ?

Original source