You must be making a non-GET (e.g. POST) request to an endpoint protected by Previously<\/strong>, with Quick links to the documentation:<\/p>\n Go to So your Imagine you're working on a plugin that needs to add a prefix, and that prefix has to be exempt from the CSRF checks. In your Note<\/strong>: prefix you're comparing to needs to match case in which you defined it. If in Further reading and context:<\/p>\n Documentation:<\/p>\n To disable the application-level protection completely, remove it from (Do not forget to put back the trailing Create a new method called Enable the above You can skip applying the middleware for the prefixes where you do not need it, e.g. Cake\\Http\\Middleware\\CsrfProtectionMiddleware<\/code>. Most likely it is enabled on the application level in your src\/Application.php<\/code><\/a>.<\/p>\nCsrfComponent<\/code> in CakePHP 3, you could have unlockedActions<\/code><\/a>. In case of this new middleware, you have two ways to approach this:<\/p>\n\n
1. 'Adding an exception' way<\/h1>\n
\n
src\/Application.php<\/code> and find the middleware()<\/code> method. By default, you will see a chain of $middlewareQueue->add()<\/code> calls. The last one will add new CsrfProtectionMiddleware<\/code>. You will have to break the chain, and manipulate your instance of this CsrfProtectionMiddleware<\/code> by adding an exception, before adding it to the queue.<\/p>\nmiddleware()<\/code> method will probably look like this.<\/p>\n$middlewareQueue\n \/\/ A bunch of standard add() calls go here\n ->add(\u2026)\n ->add(\u2026)\n \/\/ Keep routing added before before CSRF!\n ->add(new RoutingMiddleware($this))\n \/\/ Now, delete the last add() containing new CsrfProtectionMiddleware\n ;\n\n\/\/ Initialise CsrfProtectionMiddleware as separate variable we can work with\n$csrf = new CsrfProtectionMiddleware([\n 'httponly' => true,\n]);\n\/\/ Token check will be skipped when callback returns `true`.\n$csrf->skipCheckCallback(function ($request) {\n \/\/ Skip token check for API URLs.\n if ($request->getParam('prefix') === 'Api') {\n return true;\n }\n});\n\/\/ Ensure routing middleware has already been added to the queue\n$middlewareQueue->add($csrf);\n\nreturn $middlewareQueue;<\/code><\/pre>\n(For bonus points) If you need to do this from a plugin<\/h3>\n
ExamplePlugin\/src\/ExamplePlugin.php<\/code>:<\/p>\npublic function middleware(MiddlewareQueue $middlewareQueue): MiddlewareQueue\n{\n \/\/ Loop through queue directly using Iterator capabilities of MiddlewareQueue\n foreach ($middlewareQueue as $layer) {\n \/\/ Skip right away if this is not a CSRF layer\n if (!($layer instanceof \\Cake\\Http\\Middleware\\CsrfProtectionMiddleware)) {\n continue;\n }\n \/\/ Add the callback\n $layer->skipCheckCallback(function ($request) {\n \/\/ Adjust the condition to your needs; I had to allow specific prefix in current plugin\n if ($request->getParam('plugin') === $this->getName() && $request->getParam('prefix') === 'Api') {\n return true;\n }\n });\n \/\/ Once we found the CSRF layer, stop the loop as there's no need to continue\n break;\n }\n return $middlewareQueue;\n}<\/code><\/pre>\nExamplePlugin\/config\/routes.php<\/code> you defined $routes->prefix('Api', ...)<\/code>, then you do $request->getParam('prefix') === 'Api'<\/code>, not lowercase api<\/code>.<\/p>\n\n
\n
\\Cake\\Http\\MiddlewareQueue<\/code> docs: CakePHP 5<\/a>, CakePHP 4<\/a>, CakePHP 3<\/a><\/li>\n<\/ul>\n2. 'Disable-Reenable' way<\/h1>\n
Disable CSRF<\/h3>\n
Application::middleware<\/code> in src\/Application.php<\/code>.<\/p>\n- \/\/ Cross Site Request Forgery (CSRF) Protection Middleware\n- \/\/ https:\/\/book.cakephp.org\/4\/en\/controllers\/middleware.html#cross-site-request-forgery-csrf-middleware\n- ->add(new CsrfProtectionMiddleware([\n- 'httponly' => true,\n- ]));\n+ ;<\/code><\/pre>\n;<\/code>)<\/p>\nRe-enable for specific prefixes<\/h3>\n
\n
routes<\/code> in src\/Application.php<\/code> with the following contents. You can add it last.<\/p>\npublic function routes(\\Cake\\Routing\\RouteBuilder $routes) : void\n{\n \/\/ Cross Site Request Forgery (CSRF) Protection Middleware\n \/\/ https:\/\/book.cakephp.org\/4\/en\/controllers\/middleware.html#cross-site-request-forgery-csrf-middleware\n $options = [\n 'httponly' => true,\n ];\n $routes->registerMiddleware('csrf', new CsrfProtectionMiddleware($options));\n parent::routes($routes);\n}<\/code><\/pre>\nCsrfProtectionMiddleware<\/code> is now registered and available under csrf<\/code> alias.<\/p>\n<\/li>\ncsrf<\/code> for specific routes and prefixes. In config\/routes.php<\/code>:<\/p>\n$routes->scope('\/', function (RouteBuilder $builder) {\n $builder->applyMiddleware('csrf');\n \/\/ \u2026\n});\n\n$routes->prefix('Admin', function (RouteBuilder $routes) {\n $routes->applyMiddleware('csrf');\n $routes->fallbacks(DashedRoute::class);\n});<\/code><\/pre>\n<\/li>\n\/api<\/code>:<\/p>\n$routes->prefix('Api', function (RouteBuilder $routes) {\n $routes->setExtensions(['json']);\n $routes->fallbacks(DashedRoute::class);\n});<\/code><\/pre>\n<\/li>\n