{"action":"created","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/10078","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/10078/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/10078/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/10078/events","html_url":"https://github.com/yiisoft/yii2/issues/10078","id":114806982,"number":10078,"title":"Can't create form w/o _csrf hidden input","user":{"login":"gugglegum","id":1580712,"avatar_url":"https://avatars.githubusercontent.com/u/1580712?v=3","gravatar_id":"","url":"https://api.github.com/users/gugglegum","html_url":"https://github.com/gugglegum","followers_url":"https://api.github.com/users/gugglegum/followers","following_url":"https://api.github.com/users/gugglegum/following{/other_user}","gists_url":"https://api.github.com/users/gugglegum/gists{/gist_id}","starred_url":"https://api.github.com/users/gugglegum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gugglegum/subscriptions","organizations_url":"https://api.github.com/users/gugglegum/orgs","repos_url":"https://api.github.com/users/gugglegum/repos","events_url":"https://api.github.com/users/gugglegum/events{/privacy}","received_events_url":"https://api.github.com/users/gugglegum/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yiisoft/yii2/labels/status:ready%20for%20adoption","name":"status:ready for adoption","color":"02e10c"},{"url":"https://api.github.com/repos/yiisoft/yii2/labels/type:enhancement","name":"type:enhancement","color":"d7e102"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/yiisoft/yii2/milestones/9","html_url":"https://github.com/yiisoft/yii2/milestones/2.0.x","labels_url":"https://api.github.com/repos/yiisoft/yii2/milestones/9/labels","id":831720,"number":9,"title":"2.0.x","description":"","creator":{"login":"cebe","id":189796,"avatar_url":"https://avatars.githubusercontent.com/u/189796?v=3","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"open_issues":430,"closed_issues":8,"state":"open","created_at":"2014-10-19T13:49:45Z","updated_at":"2015-11-06T21:44:48Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2015-11-03T12:40:25Z","updated_at":"2015-11-06T21:44:48Z","closed_at":"2015-11-06T21:44:48Z","body":"My form is submitted to external web-site. I using `yii\\helpers\\Html::beginForm()` in View to render form open-tag. But it adds unwanted hidden input `_csrf` which is absolutely useless for external web-site which will process my POST. Moreover external site can do CSRF-attack to my site by knowing my CSRF-key. Or it may not process my request due to unknown parameter `_csrf`.\r\n\r\nUnfortunately, I have not found elegant solution to not to add this hidden input when using `beginForm()`. By analising the source code, there is no way to awoid this `_csrf` hidden input other than to set `Yii::$app->getRequest()->enableCsrfValidation = false`. But this is GLOBAL parameter! Here is fragment of yii\\helpers\\BaseHtml:\r\n\r\n```\r\n        $request = Yii::$app->getRequest();\r\n        if ($request instanceof Request) {\r\n            if (strcasecmp($method, 'get') && strcasecmp($method, 'post')) {\r\n                // simulate PUT, DELETE, etc. via POST\r\n                $hiddenInputs[] = static::hiddenInput($request->methodParam, $method);\r\n                $method = 'post';\r\n            }\r\n            if ($request->enableCsrfValidation && !strcasecmp($method, 'post')) {\r\n                $hiddenInputs[] = static::hiddenInput($request->csrfParam, $request->getCsrfToken());\r\n            }\r\n        }\r\n```\r\n\r\nI may have a several forms on one page (in one or in several view files which is included as partial or widget). Some of them may need CSRF-validation, some of them may not. And what should I do? If I do form for external web-site, I should set `enableCsrfValidation` to `false`, render form, then set `enableCsrfValidation` to `true`? More correct way is to store old value of `enableCsrfValidation` to temporary variable.\r\n\r\nBut what the hell the VIEW may want to change REQUEST? This is inappropriate behaviour. I should have a possibility to disable CSRF validation just once for single execution of `yii\\helpers\\Html::beginForm()`. This can be done via `$options`.\r\n\r\nI decided to not to use `yii\\helpers\\Html::beginForm()` and use `yii\\helpers\\Html::beginTag()` instead. But it's little less convenient."},"comment":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/comments/154550950","html_url":"https://github.com/yiisoft/yii2/issues/10078#issuecomment-154550950","issue_url":"https://api.github.com/repos/yiisoft/yii2/issues/10078","id":154550950,"user":{"login":"cebe","id":189796,"avatar_url":"https://avatars.githubusercontent.com/u/189796?v=3","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T21:44:48Z","updated_at":"2015-11-06T21:44:48Z","body":"why don't you just use plain HTML? The Yii helper method is mainly useful for starting forms for your site including all the csrf stuff. if you just need a simple for for external post, just use plain HTML to create it."}}