{"action":"created","issue":{"url":"https://api.github.com/repos/luyadev/luya/issues/1807","repository_url":"https://api.github.com/repos/luyadev/luya","labels_url":"https://api.github.com/repos/luyadev/luya/issues/1807/labels{/name}","comments_url":"https://api.github.com/repos/luyadev/luya/issues/1807/comments","events_url":"https://api.github.com/repos/luyadev/luya/issues/1807/events","html_url":"https://github.com/luyadev/luya/issues/1807","id":326052594,"number":1807,"title":"Setting View::$autoRegisterCsrf to false has no effect","user":{"login":"cebe","id":189796,"avatar_url":"https://avatars0.githubusercontent.com/u/189796?v=4","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-05-24T10:07:48Z","updated_at":"2018-05-24T10:11:33Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"### What steps will reproduce the problem?\r\n\r\nAdd the following to the config:\r\n\r\n```php\r\n        'view' => [\r\n            'autoRegisterCsrf' => false,\r\n        ],\r\n```\r\n\r\n### What is the expected result?\r\n\r\nNo csrf cookie should be generated on pages that do not contain forms.\r\n\r\n### What do you get instead?\r\n\r\n`_csrf` cookie is generated on each page request if it does not exist.\r\n\r\nWould be okay if there wasn't a law that requires to inform users when cookies are set :)\r\n\r\n### Why does this happen\r\n\r\n`luya\\web\\View` is extended by some classes (e.g. `luya\\cms\\base\\PhpBlockView`) that represent view contexts that do not represent the site-wide view context. Because `$autoRegisterCsrf = true;` by default these subclasses will enforce the CSRF cookie generation.\r\n\r\n### Additional infos\r\n\r\n| Q                | A\r\n| ---------------- | ---\r\n| LUYA Version     | 1.0.7\r\n| PHP Version      | 7.0.3\r\n| Platform         | Apache\r\n| Operating system | Debian GNU/Linux"},"comment":{"url":"https://api.github.com/repos/luyadev/luya/issues/comments/391662163","html_url":"https://github.com/luyadev/luya/issues/1807#issuecomment-391662163","issue_url":"https://api.github.com/repos/luyadev/luya/issues/1807","id":391662163,"user":{"login":"cebe","id":189796,"avatar_url":"https://avatars0.githubusercontent.com/u/189796?v=4","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"created_at":"2018-05-24T10:11:33Z","updated_at":"2018-05-24T10:11:33Z","author_association":"CONTRIBUTOR","body":"Possible options to fix it:\r\n\r\n- set `$autoRegisterCsrf = false` by default and make the default config make it true\r\n- overwrite `$autoRegisterCsrf` to false in all subclasses"}}
{"actor":{"display_login":"cebe"}}