Bug: system/Security/Security.php(289): CodeIgniter\Security\Exceptions\SecurityException::forDisallowedAction()

[stresbiz]

PHP Version

7.4

CodeIgniter4 Version

4.1.8

CodeIgniter4 Installation Method

Manual (zip or tar.gz)

Which operating systems have you tested for this bug?

Linux

Which server did you use?

apache

Database

No response

What happened?

Throughout our error logs, we are seeing 100s of the below CSRF errors:

CRITICAL - 2022-02-24 19:49:22 --> The action you requested is not allowed.
#0 /home/system/Security/Security.php(289): CodeIgniter\Security\Exceptions\SecurityException::forDisallowedAction()
#1 /home/system/Filters/CSRF.php(53): CodeIgniter\Security\Security->verify(Object(CodeIgniter\HTTP\IncomingRequest))
#2 /home/system/Filters/Filters.php(173): CodeIgniter\Filters\CSRF->before(Object(CodeIgniter\HTTP\IncomingRequest), NULL)
#3 /home/system/CodeIgniter.php(386): CodeIgniter\Filters\Filters->run('controller...', 'before')
#4 /home/system/CodeIgniter.php(320): CodeIgniter\CodeIgniter->handleRequest(NULL, Object(Config\Cache), false)
#5 /home/public/index.php(37): CodeIgniter\CodeIgniter->run()
#6 {main}

It looks like this is the SecurityException being thrown from the Security.php class:

// Do the tokens match?
if (! isset($token, $this->hash) || ! hash_equals($this->hash, $token)) {
throw SecurityException::forDisallowedAction();
}

If the tokens do not match then perhaps there is a different way to handle this, as apposed to hammering the logs with these errors / exceptions.

Steps to Reproduce

Turn on CSRF protection.

Expected Output

N/A

Anything else?

No response

[kenjis]

I recommend you check your app carefully.
The exception never happens with normal operations.
Your site (your user) is attacked or your app config is something wrong.

[stresbiz]

I recommend you check your app carefully. The exception never happens with normal operations. Your site is attacked or your app config is something wrong.

If it is some kind of bot attack, how could prevent this exception from occurring? We've tested the form repeatedly and cannot reproduce the error.

[kenjis]

We use GitHub issues to track BUGS and to track approved DEVELOPMENT work packages. We use our forum to provide SUPPORT and to discuss FEATURE REQUESTS.

If you raise an issue here that pertains to support or a feature request, it will be closed! If you are not sure if you have found a bug, raise a thread on the forum first - someone else may have encountered the same thing.
https://github.com/codeigniter4/CodeIgniter4#repository-management

[kenjis]

If it is some kind of bot attack, how could prevent this exception from occurring?

Create your own CSRF filter based on CodeIgniter\Filters\CSRF.

[stresbiz]

Thank you for your responses and assistance.