Войти с CSRF codeigniter и ajax

Question

Я сделаю безопасный вход с помощью CSRF codeigniter и ajax. но у меня проблема с моим синтаксисом. и $ config ['csrf_protection'] = TRUE;

это моя форма:

<?php echo form_open('admin/info_type_user_log/log_admin',array('id' => 'form-loginx'));?> 
     <div class="input-group" style="margin-bottom:10px;"> 
      <span class="input-group-addon lab"><span class="glyphicon glyphicon-user"></span></span> 
      <input type="text" name="username" id="username" class="form-control inp usernamex" placeholder="username" required> 
     </div> 
     <div class="input-group" style="margin-bottom:10px;"> 
      <span class="input-group-addon lab"><span class="glyphicon glyphicon-lock"></span></span> 
      <input type="password" name="password" id="password" class="form-control inp passwordx" placeholder="password" required> 
     </div> 
     <button type="submit" name="submit" class="submit_login btn btn-md btn-primary">Login</button> 
     <label><input type="checkbox" class="lihat"> lihat password</label> 
     <?php echo form_close();?> 

и это мой JavaScript:

$('#form-loginx').submit(function(e){ // Create `click` event function for login 
     e.preventDefault(); 
     var csrfName = '<?php echo $this->security->get_csrf_token_name(); ?>', 
      csrfHash = '<?php echo $this->security->get_csrf_hash(); ?>'; 
     var me = $(this); 
     $('.submit_login').html('Loading ...'); //Loading button text 

     $.ajax({ // Send the credential values to another checker.php using Ajax in POST menthod 
      url : me.attr('action'), 
      type : 'POST', 
      data : {csrfName:csrfHash,me.serialize}, 
      dataType : 'json', 
     success: function(response){ // Get the result and asign to each cases 
      $('.submit_login').html('Login'); //Loading button text 
      if(response == true){ 
       $(".alert-sukses").html("Sedang mengarahkan..").slideToggle("fast").delay(3000).slideToggle("fast"); 
       window.location.href = 'admin/info_type_user_log'; 
      }else { 
       gagal(); 
      } 
     } 
     }); 
    }); 

и мой контроллер:

function log_admin(){  
    $reponse = array('success' => true); 
    $user = $this->security->xss_clean($this->input->post('username')); 
    $pass = $this->security->xss_clean($this->input->post('password')); 

    $reponse = array(
      'csrfName' => $this->security->get_csrf_token_name(), 
      'csrfHash' => $this->security->get_csrf_hash() 
      ); 

    $cek = $this->model_admst->valid_log($user, md5($pass)); 

    if($cek->num_rows() > 0){ 

     foreach($cek->result() as $data){ 
      $sess_data['id']   = $data->id; 
      $sess_data['nama_depan'] = $data->nama_depan; 
      $sess_data['nama_belakang'] = $data->nama_belakang; 
      $sess_data['email']   = $data->email; 
      $sess_data['username']  = $data->username; 
      $sess_data['gb_user']  = $data->gb_user; 
      $sess_data['last_login'] = $data->last_login; 
      $sess_data['log_access'] = "TRUE_OK_1"; 

      $this->session->set_userdata($sess_data); 
      $this->model_admst->updateLastlogin($data->id); 
      log_helper("login", "akses login sukses"); 
     } 

     $reponse['success'] = true; 
    }else{ 
     $reponse['success'] = false; 
    } 
    echo json_encode($reponse); 
} 

и мои модели является:

function valid_log($user,$pass){ 
    $this->db->where('username', $user); 
    $this->db->where('password', $pass); 
    $this->db->where('status', 'aktif'); 
    $this->db->where('level', 'admjosslog21'); 
    $this->db->where('akses', '1'); 
    return $this->db->get('user'); 
} 

Answer 1

Попробуйте этот код

$("#state1").change(function() { 
      $.ajax({ 
       url: "<?php echo base_url('admin/get_districtsfromstates'); ?>", 
       type: "POST", 
       data: {id: $(this).val(),'<?php echo $this->security->get_csrf_token_name(); ?>': '<?php echo $this->security->get_csrf_hash(); ?>'}, 
       success: function (data) 
       { 
        $("#district1").html(data); 
       } 
      }); 
     }); 

Answer 2

Пропустите token name и hash key асинхронность, а затем получить его через пост в контроллере

data : {csrfName:csrfName,csrfHash:csrfHash,me.serialize}, 

В контроллере

$reponse = array(
     'csrfName' => $this->input->post('csrfName'), 
     'csrfHash' => $this->input->post('csrfHash') 
     ); 

Answer 3

PHP в Javascript является уродливым решение, просто введите белый список ваших скриптов, например:

$config['csrf_exclude_uris'] = array(
'admin/log_admin', '...', '...', 
);