Cakephp获取有关安全组件错误的详细信息

Question

我在我的项目中使用安全组件,有没有办法在开发时获得有关错误的详细描述？例如: - 如果在视图中添加任何字段而不使用cakephp的form方法,则在blackHoleCallback函数中返回错误为'auth'.相反,我需要因为它返回错误的原因.因为它需要花费很多时间来纠正这个问题.有没有办法得到详细的错误描述？

Answer 1

您所要做的就是在正确的地方寻找

检查你的app/tmp/logs/error.log文件

如果您查看错误日志,您将看到如下条目:

2013-03-16 17:24:29 Error: [BadRequestException] The request has been black-holed
#0 root/lib/Cake/Controller/Component/SecurityComponent.php(228): SecurityComponent->blackHole(Object(FacebookUsersController), 'csrf')
#1 [internal function]: SecurityComponent->startup(Object(FacebookUsersController))
#2 root/lib/Cake/Utility/ObjectCollection.php(130): call_user_func_array(Array, Array)
#3 [internal function]: ObjectCollection->trigger(Object(CakeEvent))
#4 root/lib/Cake/Event/CakeEventManager.php(246): call_user_func(Array, Object(CakeEvent))
#5 root/lib/Cake/Controller/Controller.php(670): CakeEventManager->dispatch(Object(CakeEvent))
#6 root/lib/Cake/Routing/Dispatcher.php(183): Controller->startupProcess()
#7 root/lib/Cake/Routing/Dispatcher.php(161): Dispatcher->_invoke(Object(FacebookUsersController), Object(CakeRequest), Object(CakeResponse))
#8 root/app/webroot/index.php(96): Dispatcher->dispatch(Object(CakeRequest), Object(CakeResponse))
#9 {main}

阅读屏幕上的错误

如果处于调试模式,则错误发生时屏幕上也会显示此错误.例如:

The request has been black-holed
Error: The requested address '/admin/fooby/edit/1' was not found on this server.

Stack Trace
CORE/Cake/Controller/Component/SecurityComponent.php line 228 ? SecurityComponent->blackHole(FacebookUsersController, string)
[internal function] ? SecurityComponent->startup(FacebookUsersController)
CORE/Cake/Utility/ObjectCollection.php line 130 ? call_user_func_array(array, array)
[internal function] ? ObjectCollection->trigger(CakeEvent)
CORE/Cake/Event/CakeEventManager.php line 246 ? call_user_func(array, CakeEvent)
CORE/Cake/Controller/Controller.php line 670 ? CakeEventManager->dispatch(CakeEvent)
CORE/Cake/Routing/Dispatcher.php line 183 ? Controller->startupProcess()
CORE/Cake/Routing/Dispatcher.php line 161 ? Dispatcher->_invoke(FacebookUsersController, CakeRequest, CakeResponse)
APP/webroot/index.php line 96 ? Dispatcher->dispatch(CakeRequest, CakeResponse)

处理csrf错误

随着细节一个的特定错误(即您发布的数据,并在会议当时的确切令牌数据),这将是不可能回答哪些问题带你来这里,在这由于缺少:

看看抛出错误的那一行.

在上面的堆栈跟踪中,错误来自CORE/Cake/Controller/Component/SecurityComponent.php line 228- 打开文件并查看该代码是什么:

if ($isPost && $isNotRequestAction && $this->csrfCheck) {
    if ($this->_validateCsrf($controller) === false) {
        return $this->blackHole($controller, 'csrf');
    }   
}

从中可以明显看出,该函数_validateCsrf负责对请求进行黑洞处理.这不应该是一个惊喜.

看看那个函数的来源:

protected function _validateCsrf(Controller $controller) {
    $token = $this->Session->read('_Token');
    $requestToken = $controller->request->data('_Token.key');
    if (isset($token['csrfTokens'][$requestToken]) && $token['csrfTokens'][$requestToken] >= time()) {
        if ($this->csrfUseOnce) {
            $this->Session->delete('_Token.csrfTokens.' . $requestToken);
        }
        return true;
    }
    return false;
}

根据该函数返回false的原因,确定继续调试的方式.

正确配置组件

调试CSRF错误的必然结果是您需要修改安全组件的配置.

例如,您是否想要重复使用令牌,因为您的应用在页面加载之间多次提交相同的表单？

您是否通过向表单数据添加新字段来自动使表单请求失效 - 您可以使用unlockedFields属性从csrf检查中排除这些字段.

您也可以完全禁用CSRF检查.这有明显的安全后果 - 但如果您正在努力使用该组件,那么这是一种简单的解决方法,也是您目前遇到的问题.