Codeigniter: Paypal IP address and csrf_protection

Question

I work with codeigniter-paypal-ipn and csrf_protection is enabled. This seems to block access from Paypal to my IPN controller. If I turn off csrf_protection, it works fine, with csrf_protection turned on, the PayPal IPN service gives 500 Internal server error.

Is there a way to solve this problem without disabling the csrf_protection function? If not, can I disable csrf_protection only for this controller?

Thanks.

Answer 1

Alex is the creator of codeigniter-paypal-ipn here. At the moment, I don’t know how to get an IPN message working with csrf_protection enabled. If you look at how another language / framework does it, for example, django-paypal IPN - they add a CSRF exception for a specific IPN controller .

As imm says, this type of fine-grained control will not be available in CodeIgniter until the version with this pull request merges (if you cannot wait, try the caseyamcl approach below, since it does not include hacking the CI kernel ...)

I updated my README project to make the CSRF situation clearer.

Answer 2

I know that the question was answered, but I did it in the same way without breaking the CI core. I added the following to the application / config / config.php file:

$config['csrf_ignore'] = array('api'); 

An array can include any paths you like. The above example applies to any paths starting with "api".

Then I added the following file: application / core / MY_Input.php :

 <?php if ( ! defined('BASEPATH')) exit('No direct script access allowed'); class MY_Input extends CI_Input { function _sanitize_globals() { $ignore_csrf = config_item('csrf_ignore'); if (is_array($ignore_csrf) && count($ignore_csrf)) { global $URI; $haystack = $URI->uri_string(); foreach($ignore_csrf as $needle) { if (strlen($haystack) >= strlen($needle) && substr($haystack, 0, strlen($needle)) == $needle) { $this->_enable_csrf = FALSE; break; } } } parent::_sanitize_globals(); } } /* EOF: MY_Input */ 

Answer 3

Someone asked a similar question at http://ellislab.com/forums/viewthread/200625/ , disabling csrf for one controller, the next version will be available.