GET forms MUST NOT have CSRF tokens

Created on 26 September 2015, over 9 years ago
Updated 16 February 2025, about 2 months ago

Problem/Motivation

From the DrupalCon Barcelona Hard Problems Meeting on performance:

Wim: GET forms shouldn't have CSRF tokens — https://www.drupal.org/node/2571995
Alex: I have a use case
Crell: CSRF token in the URL is a bad thing, just like a session ID in there is a bad thing
Crell: we should make it an opt-in thing (i.e. default GET forms to #token = FALSE)
Alex: Oh, now I realized that I actually don't have a use case, we found that to be wrong.
Catch: we should verify that it actually offers any protection, if it’s not, then we should not even make it opt-in, we should make it impossible, and document it

So, step 1 is #2571995: GET forms shouldn't have CSRF tokens by default , this is step 2.

Proposed resolution

Prevent GET forms from ever having a CSRF token.

Remaining tasks

  1. Investigate
  2. If conclusion supports our hypothesis, implement

User interface changes

None.

API changes

None.

Data model changes

None.

📌 Task
Status

Needs work

Version

11.0 🔥

Component

forms system

Created by

🇧🇪Belgium wim leers Ghent 🇧🇪🇪🇺

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024