{"action":"created","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/7828","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/7828/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/7828/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/7828/events","html_url":"https://github.com/cakephp/cakephp/issues/7828","id":121505731,"number":7828,"title":"3.0 - $this->enableCsrfToken() fail with many requests in the same testAction","user":{"login":"Xety","id":8210023,"avatar_url":"https://avatars.githubusercontent.com/u/8210023?v=3","gravatar_id":"","url":"https://api.github.com/users/Xety","html_url":"https://github.com/Xety","followers_url":"https://api.github.com/users/Xety/followers","following_url":"https://api.github.com/users/Xety/following{/other_user}","gists_url":"https://api.github.com/users/Xety/gists{/gist_id}","starred_url":"https://api.github.com/users/Xety/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Xety/subscriptions","organizations_url":"https://api.github.com/users/Xety/orgs","repos_url":"https://api.github.com/users/Xety/repos","events_url":"https://api.github.com/users/Xety/events{/privacy}","received_events_url":"https://api.github.com/users/Xety/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cakephp/cakephp/labels/Defect","name":"Defect","color":"f7c6c7"},{"url":"https://api.github.com/repos/cakephp/cakephp/labels/testing","name":"testing","color":"FFFFFF"}],"state":"open","locked":false,"assignee":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/cakephp/cakephp/milestones/68","html_url":"https://github.com/cakephp/cakephp/milestones/3.1.6","labels_url":"https://api.github.com/repos/cakephp/cakephp/milestones/68/labels","id":1434393,"number":68,"title":"3.1.6","description":"Bugfixes and optimizations for the 3.1 branch","creator":{"login":"markstory","id":24086,"avatar_url":"https://avatars.githubusercontent.com/u/24086?v=3","gravatar_id":"","url":"https://api.github.com/users/markstory","html_url":"https://github.com/markstory","followers_url":"https://api.github.com/users/markstory/followers","following_url":"https://api.github.com/users/markstory/following{/other_user}","gists_url":"https://api.github.com/users/markstory/gists{/gist_id}","starred_url":"https://api.github.com/users/markstory/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markstory/subscriptions","organizations_url":"https://api.github.com/users/markstory/orgs","repos_url":"https://api.github.com/users/markstory/repos","events_url":"https://api.github.com/users/markstory/events{/privacy}","received_events_url":"https://api.github.com/users/markstory/received_events","type":"User","site_admin":false},"open_issues":19,"closed_issues":47,"state":"open","created_at":"2015-11-30T03:21:51Z","updated_at":"2015-12-10T16:35:17Z","due_on":"2015-12-22T05:00:00Z","closed_at":null},"comments":4,"created_at":"2015-12-10T15:02:50Z","updated_at":"2015-12-10T16:45:10Z","closed_at":null,"body":"### 1. Bug with `enableCsrfToken()`\r\n```php\r\npublic function testDebug()\r\n{\r\n    $data = [\r\n        'username' => 'mariano',\r\n        'password' => 'password'\r\n    ];\r\n    $this->enableCsrfToken();\r\n    \r\n    //Pass\r\n    $this->post(['controller' => 'users', 'action' => 'login'], $data);\r\n    $this->assertResponseOk();\r\n\r\n    //Fail CSRF token doesn't match.\r\n    $this->post(['controller' => 'users', 'action' => 'login'], $data);\r\n    $this->assertResponseOk();\r\n}\r\n```\r\nThis is caused by https://github.com/cakephp/cakephp/blob/master/src/TestSuite/IntegrationTestCase.php#L437\r\n\r\n#### Solution :\r\n```php\r\nif ($this->_csrfToken === true) {\r\n    $csrfToken = Text::uuid();\r\n    $csrfGenerated = false;\r\n\r\n    if (!isset($data['_csrfToken'])) {\r\n        $data['_csrfToken'] = $csrfToken;\r\n        $csrfGenerated = true;\r\n    }\r\n    if (!isset($this->_cookie['csrfToken']) || $csrfGenerated) {\r\n        $this->_cookie['csrfToken'] = $csrfToken;\r\n    }\r\n}\r\n```\r\nAnd it work well.\r\n\r\n### 2. Proposal of a new function `disableCsrfToken()`\r\nAlso, it would be nice to have a method `disableCsrfToken()`, because when we call `enableCsrfToken()`, it enable the csrf for all requests in the action.\r\nBut if for X or Y reason, we need to disable it for a special request, we can't . (Well, we can with `$this->_csrfToken = false`, but it's more logic to use a function called `disableCsrfToken()`)\r\n\r\nExemple usage :\r\n```php\r\npublic function testDebug()\r\n{\r\n    $data = [\r\n        'username' => 'mariano',\r\n        'password' => 'password'\r\n    ];\r\n    $this->enableCsrfToken();\r\n    \r\n    $this->post(['controller' => 'users', 'action' => 'login'], $data);\r\n    $this->assertResponseOk();\r\n\r\n    $this->disableCsrfToken();\r\n\r\n    $this->post(['controller' => 'users', 'action' => 'login'], $data);\r\n    $this->assertResponseOk();\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/comments/163683401","html_url":"https://github.com/cakephp/cakephp/issues/7828#issuecomment-163683401","issue_url":"https://api.github.com/repos/cakephp/cakephp/issues/7828","id":163683401,"user":{"login":"Xety","id":8210023,"avatar_url":"https://avatars.githubusercontent.com/u/8210023?v=3","gravatar_id":"","url":"https://api.github.com/users/Xety","html_url":"https://github.com/Xety","followers_url":"https://api.github.com/users/Xety/followers","following_url":"https://api.github.com/users/Xety/following{/other_user}","gists_url":"https://api.github.com/users/Xety/gists{/gist_id}","starred_url":"https://api.github.com/users/Xety/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Xety/subscriptions","organizations_url":"https://api.github.com/users/Xety/orgs","repos_url":"https://api.github.com/users/Xety/repos","events_url":"https://api.github.com/users/Xety/events{/privacy}","received_events_url":"https://api.github.com/users/Xety/received_events","type":"User","site_admin":false},"created_at":"2015-12-10T16:45:09Z","updated_at":"2015-12-10T16:45:09Z","body":"@markstory Yeah i understand your point. Anyway, we can still do it with `$this->_csrfToken = false` if we really need it.\r\n\r\n@dereuromark Yes, i know it's not good to make several requests in the same action. But sometime, with simple requests, i do it... :stuck_out_tongue_closed_eyes:"}}