<p>the CSRF field its a hidden field not part of the form attributes.<br>
You don't have to manually type it, craft twig comes with <code>{{ getCsrfInput() }}</code> that recreates a hidden field between the <code>&lt;form>&lt;/form></code> tags.</p>

<pre><code>&lt;form method="post"&gt;
    {{ getCsrfInput() }}
    &lt;!-- ... --&gt;
&lt;/form&gt;
</code></pre>

<p>Also, that seems to be a Javascript call if you are doing Ajax you need to add those variables to the script so the action knows about them. </p>

<pre><code>&lt;script&gt;
window.csrfTokenName = "{{ craft.config.csrfTokenName|e('js') }}";
window.csrfTokenValue = "{{ craft.request.csrfToken|e('js') }}";
&lt;/script&gt;
</code></pre>

<p>Usually works for me.</p>

CC BY-SA 3.0
2016-03-30T17:04:19.623Z
Related: http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes
Lindsey D
CC BY-SA 3.0
2016-03-30T13:59:10.493Z
2016-03-30T13:59:10.493Z
Xpertbot
<p>I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:</p>

<pre><code>    &lt;script type="text/javascript"&gt;
    var cookieTest = 'CraftCookieTest='+Math.floor(Math.random() * 1000000);
    document.cookie = cookieTest;
    var cookiesEnabled = document.cookie.search(cookieTest) != -1;
    if (cookiesEnabled)
    {
        document.cookie = cookieTest + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';

        document.write(
            '{%- set hasLogo = (CraftEdition &gt;= CraftClient and craft.rebrand.isLogoUploaded ? true : false) -%}'+
            '&lt;form id="login-form" method="post" accept-charset="UTF-8" name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}" {% if hasLogo -%}
                    {%- set logo = craft.rebrand.logo -%}
                    {%- set padding = logo.height + 30 -%}
                    class="has-logo" style="background-image: url(\'{{ logo.url }}\'); background-size: {{ logo.width }}px {{ logo.height }}px; padding-top: {{ padding }}px; margin-top: -{{ round((353+padding)/2) }}px"
                {%- endif %}&gt;' +
                '{% if not hasLogo -%}&lt;h1&gt;{{ siteName }}&lt;/h1&gt;{%- endif %}'+
                '{% set placeHolderText = (craft.config.useEmailAsUsername ? "Email"|t : "Username or Email"|t) %}' +
                '{{ forms.textField({ id: "loginName", name: "username", placeholder: placeHolderText, value: username })|e("js") }}' +

                '&lt;div id="login-fields" class="nested-fields"&gt;' +
                    '{{ forms.passwordField({ id: "password", name: "password", placeholder: "Password"|t })|e("js") }}' +
                    '&lt;a id="forgot-password"&gt;{{ "Forget your password?"|t }}&lt;/a&gt;' +
                    {% if craft.config.rememberedUserSessionDuration %}
                        '{{ forms.checkboxField({ id: "rememberMe", label: "Keep me logged in"|t })|e("js") }}' +
                    {% endif %}
                '&lt;/div&gt;' +

                '&lt;div class="buttons"&gt;' +
                    '{# &lt;div id="ssl-icon" class="disabled"&gt;&lt;div class="{{ craft.request.isSecure ? "secure" : "insecure" }} icon"&gt;&lt;/div&gt;&lt;/div&gt;#}' +
                    '&lt;input id="submit" class="btn submit disabled" type="submit" value="{{ "Login"|t }}"&gt;' +
                    '&lt;div id="spinner" class="spinner hidden"&gt;&lt;/div&gt;' +
                '&lt;/div&gt;' +
                '&lt;a id="poweredby" href="http://craftcms.com/" title="{{ "Powered by Craft CMS"|t }}"&gt;&lt;img src="{{ resourceUrl("images/craftcms.svg") }}" /&gt;&lt;/a&gt;'+
            '&lt;/form&gt;'
        );

        {% if not craft.request.isMobileBrowser(true) %}
            document.getElementById("{{ (username ? 'password' : 'loginName') }}").focus();
        {% endif %}
    }
    else
    {
        document.write(
            '&lt;div class="no-access"&gt;' +
                '&lt;div class="pane"&gt;' +
                    '&lt;div class="pane-body"&gt;' +
                        '&lt;div class="notice"&gt;' +
                            '&lt;div class="icon"&gt;&lt;/div&gt;' +
                            '&lt;p&gt;{{ "Cookies must be enabled to access the Craft CMS control panel."|t }}&lt;br&gt;' +
                                '&lt;a class="go nowrap" href=""&gt;{{ "See how"|t }}&lt;/a&gt;' +
                            '&lt;/p&gt;' +
                        '&lt;/div&gt;' +
                    '&lt;/div&gt;' +
                '&lt;/div&gt;' +
            '&lt;/div&gt;'
        );
    }
&lt;/script&gt;
</code></pre>

<p>I believe this is all correct, but not sure how this could be tested? </p>

<p>Thanks</p>

<admin><login><csrf>
CSRF admin Login
# CSRF admin Login

(Asked by: username_0 on 2016-03-30)

I'm trying to get CSRF in the craft login form. I've added the config setting ('enableCsrfProtection' => true,) and added 'name="{{ craft.config.csrfTokenName }}" value="{{ craft.request.csrfToken }}"' to the login form:
    

I believe this is all correct, but not sure how this could be tested? 
Thanks

**Tags:** admin, login, csrf


---

## 1 answers

### Answer by username_1 on 2016-03-30. Score: 2 | Accepted answer

the CSRF field its a hidden field not part of the form attributes.
You don't have to manually type it, craft twig comes with {{ getCsrfInput() }} that recreates a hidden field between the  tags.

    {{ getCsrfInput() }}
    


Also, that seems to be a Javascript call if you are doing Ajax you need to add those variables to the script so the action knows about them. 


Usually works for me.

> **Comments:**
> **username_2**: Related: http://craftcms.stackexchange.com/questions/6580/how-can-i-use-csrf-protection-with-ajax-routes  

---

