Feature: CSRF Protection #1195
Comments
julianhofmann
added a commit
that referenced
this issue
Dec 5, 2024
The use of the token is intended to prevent CSRF attacks. As a positive side effect, it also prevents (accidental) repeated sending. This occurs on iPhones, for example, when the browser is reopened and the success page was still open in a tab) See: https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/Authentication/CSRFlikeRequestTokenHandling.html Related: #286 Related: #1195
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The use of
FormProtectionsuggested in #286 would require a logged-in user. We do not necessarily have this when using Powermail.Since TYPO3 v12, however, there is the ‘CSRF-like request token handling’, which does not require a logged-in user (but uses its own cookie).
This token procedure could be used for the
createActionto prevent repeated sending or automated completion after previous crawling.As a positive side effect, it also prevents (accidental) repeated sending. This occurs on iPhones, for example, when the browser is reopened and the confirmation page was still open in a tab)
The text was updated successfully, but these errors were encountered: