<p>Try to disable the CSRF protection by event</p>
<pre><code>use Yii;
use yii\base\ActionEvent;
use yii\base\Event;
use yii\web\Controller;

Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
    if ($actionEvent-&gt;action-&gt;id == 'facebook') {
        Yii::$app-&gt;controller-&gt;enableCsrfValidation = false;
    }
});
</code></pre>

CC BY-SA 4.0
2021-05-25T08:29:13.997Z
2021-05-25T08:29:13.997Z
Mostafa Soufi
<p>You can disable the token for a certain controller via </p>

<pre class="lang-php prettyprint-override"><code>use Craft;
...
Yii::$app-&gt;controller-&gt;enableCsrfValidation = false;
</code></pre>

<p>or inside a Controller for a certain request</p>

<pre class="lang-php prettyprint-override"><code>/**
 * @inheritdoc
 */
public function beforeAction($action)
{            
    if ($action-&gt;id == 'my-method') {
        $this-&gt;enableCsrfValidation = false;
    }

    return parent::beforeAction($action);
}
</code></pre>

<p>Take a look at <a href="http://www.yiiframework.com/doc-2.0/yii-web-controller.html#$enableCsrfValidation-detail" rel="nofollow noreferrer">$enableCsrfValidation</a> property of <a href="http://www.yiiframework.com/doc-2.0/yii-web-controller.html" rel="nofollow noreferrer">yii\web\Controller</a>.</p>

CC BY-SA 4.0
2018-08-28T16:15:34.407Z
2018-08-28T16:15:34.407Z
Robin Schambach
<p>I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook</p>

<p>Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.</p>

<p>I don't want to disable CSRF - what could i do... plugin with a controller to render the template?</p>

<csrf><post>
Craft CSRF protection and Facebook Tab
# Craft CSRF protection and Facebook Tab

(Asked by: username_0 on 2018-08-28)

I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook

Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.

I don't want to disable CSRF - what could i do... plugin with a controller to render the template?

**Tags:** csrf, post

---

## 2 answers

### Answer by username_1 on 2021-05-25. Score: 1

Try to disable the CSRF protection by event
use Yii;
use yii\base\ActionEvent;
use yii\base\Event;
use yii\web\Controller;

Event::on(Controller::class, Controller::EVENT_BEFORE_ACTION, function (ActionEvent $actionEvent) {
    if ($actionEvent->action->id == 'facebook') {
        Yii::$app->controller->enableCsrfValidation = false;
    }
});


---

### Answer by username_2 on 2018-08-28. Score: 1

You can disable the token for a certain controller via 
use Craft;
...
Yii::$app->controller->enableCsrfValidation = false;

or inside a Controller for a certain request
/**
 * @inheritdoc
 */
public function beforeAction($action)
{            
    if ($action->id == 'my-method') {
        $this->enableCsrfValidation = false;
    }

    return parent::beforeAction($action);
}

Take a look at $enableCsrfValidation property of yii\web\Controller.


---

