感谢@John提出自己实现 CSRF 的建议，我通过了第一个问题。然而，事实证明 IE 根本没有提交发布数据（在调试之后）所以，stackoverflow 上有一个标题IE 拒绝通过 $.ajax 发送数据
的问题，要解决这个问题，你必须添加这个meta标签告诉 IE 在 IE9 兼容模式下使用 javascript。
<meta http-equiv="x-ua-compatible" content="IE=9" >
现在，对于关于使用钩子解决 csrf 的文章，它忽略了一个问题，即如果您正在使用.serializeArray()jquery 或任何等效项来提交表单，您需要修改
validate_tokens函数以检查token_name已发布数组的内部。
希望这可以拯救遇到同样问题的人
注意：在不重写 csrf 的情况下添加 meta 标签不会解决问题。
更新1：
这是我正在使用的实现：
<?php
/**
* Description of csrf_protection
* @author Ian Murray
*/
class Csrf_Protection {
private $CI;
private static $token_name = 'somename';
private static $token;
public function __construct() {
$this->CI = &get_instance();
}
/**
* Generates a CSRF token and stores it on session. Only one token per session is generated.
* This must be tied to a post-controller hook, and before the hook
* that calls the inject_tokens method().
*
* @return void
* @author Ian Murray
*/
public function generate_token()
{
// Load session library if not loaded
$this->CI->load->library('session');
if ($this->CI->session->userdata(self::$token_name) === FALSE)
{
// Generate a token and store it on session, since old one appears to have expired.
self::$token = md5(uniqid() . microtime() . rand());
$this->CI->session->set_userdata(self::$token_name, self::$token);
}
else
{
// Set it to local variable for easy access
self::$token = $this->CI->session->userdata(self::$token_name);
}
}
/**
* Validates a submitted token when POST request is made.
*
* @return void
* @author Ian Murray
*/
public function validate_tokens()
{
// Is this a post request?
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
// Is the token field set and valid?
$posted_token = $this->CI->input->post(self::$token_name);
if($posted_token === FALSE){
$posted_token = $this->_get_token_in_post_array($this->CI->input->post());
$this->_check_all_post_array($posted_token);
}
}
}
/**
*takes the posted token and check it after multidimesional-array search
*@params $posted_token
*@author Mamdouh Alramadan
*/
private function _check_all_post_array($posted_token)
{
if ($posted_token === 'error' || $posted_token != $this->CI->session->userdata(self::$token_name))
{
// Invalid request, send error 400.
show_error('Request was invalid. Tokens did not match.', 400);
}
}
/**
* This injects hidden tags on all POST forms with the csrf token.
* Also injects meta headers in <head> of output (if exists) for easy access
* from JS frameworks.
*
* @return void
* @author Ian Murray
*/
public function inject_tokens()
{
$output = $this->CI->output->get_output();
// Inject into form
$output = preg_replace('/(<(form|FORM)[^>]*(method|METHOD)="(post|POST)"[^>]*>)/',
'$0<input type="hidden" name="' . self::$token_name . '" value="' . self::$token . '">',
$output);
// Inject into <head>
$output = preg_replace('/(<\/head>)/',
'<meta name="cname" content="' . self::$token_name . '">' . "\n" . '<meta name="cval" content="' . self::$token . '">' . "\n" . '$0',
$output);
$this->CI->output->_display($output);
}
/**
* takes the posted array and check for the token inside it
* @params $arr array
* @author Mamdouh Alramadan
*/
private function _get_token_in_post_array($arr)
{//this function is customized to my case but it's easy to adapt
if(is_array($arr)){
$key = $this->_recursive_post_array_search(self::$token_name, $arr);//this will return data if token found
if($key === 'data'){//I'm expecting the token inside data array
$key = $this->_recursive_post_array_search(self::$token_name, $arr['data']);
return isset($arr['data'][$key]['value'])?$arr['data'][$key]['value']:FALSE;
}
}
return 'error';
}
//some custom function to do multi-dimensional array search, can be replaced with any other searching function.
private function _recursive_post_array_search($needle,$haystack) {
foreach($haystack as $key=>$value) {
$current_key=$key;
if($needle===$value OR (is_array($value) && $this->_recursive_post_array_search($needle,$value) !== false)) {
return $current_key;
}
}
return false;
}
}
?>
