Skip to content

Commit c2fef51

Browse files
author
epriestley
committed
Refine error messages for CSRF exceptions
Summary: See T489. Provide slightly more detail so we can figure out if there's a real issue here. Test Plan: Hit URIs like: /differential/comment/preview/29/ /differential/comment/preview/29/?__ajax__=1 /differential/comment/preview/29/?__csrf__=1 ..and got appropriate error messages. Reviewers: jungejason Reviewed By: jungejason CC: aran, jungejason Differential Revision: 884
1 parent 83f1140 commit c2fef51

File tree

1 file changed

+18
-1
lines changed

1 file changed

+18
-1
lines changed

src/aphront/request/AphrontRequest.php

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,22 @@ final public function validateCSRF() {
145145

146146
$valid = $this->getUser()->validateCSRFToken($token);
147147
if (!$valid) {
148+
149+
// Add some diagnostic details so we can figure out if some CSRF issues
150+
// are JS problems or people accessing Ajax URIs directly with their
151+
// browsers.
152+
if ($token) {
153+
$token_info = "with an invalid CSRF token";
154+
} else {
155+
$token_info = "without a CSRF token";
156+
}
157+
158+
if ($this->isAjax()) {
159+
$more_info = "(This was an Ajax request, {$token_info}.)";
160+
} else {
161+
$more_info = "(This was a web request, {$token_info}.)";
162+
}
163+
148164
// This should only be able to happen if you load a form, pull your
149165
// internet for 6 hours, and then reconnect and immediately submit,
150166
// but give the user some indication of what happened since the workflow
@@ -155,7 +171,8 @@ final public function validateCSRF() {
155171
"certain type of login hijacking attack. However, the token can ".
156172
"become invalid if you leave a page open for more than six hours ".
157173
"without a connection to the internet. To fix this problem: reload ".
158-
"the page, and then resubmit it.");
174+
"the page, and then resubmit it.\n\n".
175+
$more_info);
159176
}
160177

161178
return true;

0 commit comments

Comments
 (0)