O'Reilly logo

Drupal 8 Module Development by Daniel Sipos

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

CSRF protection on routes

Drupal comes equipped with various tools for handling CSRF protection.

Cross Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.
-(OWASP)

One such tool is for handling the addition of a CSRF token to a route built using the Drupal API automatically. Let's take a look at an example.

Imagine that you have a route that is used as some sort of a callback. Hitting this route triggers a process (typically for logged-in users), so you need to make sure that users only end up on this route from the place they should come (part of the flow that needs to trigger that process). Tokens can be used for this, and Drupal 8 has ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required