Override CSRF protection for POST requests [$73 awarded] #635

New Issue

2026-10-05T04:35:17+02:00

adam commented

2026-10-05 04:35:17 +02:00

Is it possible to disable/override the CSRF protection token verification requirement for a module's OnWebRequest listener?

I believe the check is performed here - there doesn't appear to be a way to disable it.

--- The **[$73 bounty](https://www.bountysource.com/issues/28076404-override-csrf-protection-for-post-requests?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue has been claimed at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

Is it possible to disable/override the CSRF protection token verification requirement for a module's OnWebRequest listener? I believe the check is performed [here](https://github.com/znc/znc/blob/d66cb36cc3cef65f472f4c6535128b9f785c94b4/src/WebModules.cpp#L608) - there doesn't appear to be a way to disable it. ## <bountysource-plugin> --- The **[$73 bounty](https://www.bountysource.com/issues/28076404-override-csrf-protection-for-post-requests?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** on this issue has been claimed at [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam closed this issue

2026-10-05 04:35:17 +02:00

adam commented

2026-10-05 04:35:18 +02:00

Am I understanding you correctly: You are writing a module foo and it offers a web page /bar and you want to disable the CSRF protection for this specific page?
Why would you want/need that?

Am I understanding you correctly: You are writing a module `foo` and it offers a web page `/bar` and you want to disable the CSRF protection for this specific page? Why would you want/need that?

adam commented

2026-10-05 04:35:19 +02:00

Hi @psychon,

That's correct. In my case, it's not a webpage but it's a route in a RESTful API I'm working on. For one of the routes, a POST action makes the most sense and there's no real way that the API client would be able to know the CSRF token (nor should it be expected to).

Cheers!

Hi @psychon, That's correct. In my case, it's not a webpage but it's a route in a RESTful API I'm working on. For one of the routes, a POST action makes the most sense and there's no real way that the API client would be able to know the CSRF token (nor should it be expected to). Cheers!

adam commented

2026-10-05 04:35:20 +02:00

Is HTTP-Basic auth an option for you?

Is HTTP-Basic auth an option for you?

adam commented

2026-10-05 04:35:20 +02:00

Not in this case, the API is designed to be accessible to anyone (no authentication should be required).

Not in this case, the API is designed to be accessible to anyone (no authentication should be required).

adam commented

2026-10-05 04:35:21 +02:00

So, are you looking for WebRequiresLogin() { return false; }?
https://github.com/znc/znc/blob/73d5f382f83eb1cd77d3ea4afb98e132fb6f4705/include/znc/Modules.h#L422-L425

Edit: Ohhhhh, now I get it!
You already have WebRequireLogin() returning false, but of course the CSRF check is still run.

So, are you looking for `WebRequiresLogin() { return false; }`? https://github.com/znc/znc/blob/73d5f382f83eb1cd77d3ea4afb98e132fb6f4705/include/znc/Modules.h#L422-L425 Edit: Ohhhhh, now I get it! You already have WebRequireLogin() returning false, but of course the CSRF check is still run.

adam commented

2026-10-05 04:35:22 +02:00

Edit: Ohhhhh, now I get it!
You already have WebRequireLogin() returning false, but of course the CSRF check is still run.

Yup. I've worked around it so far by forcing use of GET requests but it's not ideal, especially when you have a lot of data (gets messy putting it in the query string).

> Edit: Ohhhhh, now I get it! > You already have WebRequireLogin() returning false, but of course the CSRF check is still run. Yup. I've worked around it so far by forcing use of GET requests but it's not ideal, especially when you have a lot of data (gets messy putting it in the query string).

adam commented

2026-10-05 04:35:22 +02:00

I've added a bounty on this since it was annoying me and I'd like to do some further API work in my module.

Ideally I think there'd be a virtual EModRet OnCsrfCheck(CWebSock& WebSock, const CString& sPageName); (and then I could return HALT) or perhaps a virtual bool RequiresCsrfCheck(CWebSock& WebSock, const CString& sPageName); where I could just return false for API requests.

I've added a bounty on this since it was annoying me and I'd like to do some further API work in my module. Ideally I think there'd be a `virtual EModRet OnCsrfCheck(CWebSock& WebSock, const CString& sPageName);` (and then I could return HALT) or perhaps a `virtual bool RequiresCsrfCheck(CWebSock& WebSock, const CString& sPageName);` where I could just return `false` for API requests.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#635