Phabricator AphrontRequest / Save Error Fix

By  on  

Working on Phabricator extensions has thrust me back into the world of PHP, a language I had only touched via WordPress plugins and blog themes over the past few years.  Despite being away from the language, I was able to jump back in fairly quickly and felt a small "back at home" comfort...until I realized Phabricator was not greatly documented and that I'd need to dive deep into the source code to figure out how to do just about every task.

One error that baffled me for a while was the following:

You are trying to save some data to Phabricator, but the request your browser made included an incorrect token. Reload the page and try again. You may need to clear your cookies.

I was trying to create and save a PhabricatorAuthTemporaryToken instance for the sake of allowing login via a third party service, and the request from that service to Phabricator was made in the background, so there was no PHCID because there was no session, thus the CSRF token was invalid.  Essentially I needed a way to write to Phabricator without a CSRF validation (via PHCID) step.  The solution was simple:

// Turn off CSRF check
$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
// Save token
id(new PhabricatorAuthTemporaryToken())
  ->setTokenResource($transaction_code)
  // ...
  ->save();
// Turn CSRF check back on
unset($unguarded);

AphrontWriteGuard::beginScopedUnguardedWrites() allowed me to turn of the CSRF check, save the token, and then turn the CSRF check back on via unset.  Short amount of code but took a long time to find!

I love that advanced libraries like Phabricator insist on these security checks without developers having to do so explicitly; I also love that turning off this check momentarily is easy.  I'll be sure to share more PHP / Phabricator tips as I run into problems!

Recent Features

  • By
    5 Ways that CSS and JavaScript Interact That You May Not Know About

    CSS and JavaScript:  the lines seemingly get blurred by each browser release.  They have always done a very different job but in the end they are both front-end technologies so they need do need to work closely.  We have our .js files and our .css, but...

  • By
    CSS Animations Between Media Queries

    CSS animations are right up there with sliced bread. CSS animations are efficient because they can be hardware accelerated, they require no JavaScript overhead, and they are composed of very little CSS code. Quite often we add CSS transforms to elements via CSS during...

Incredible Demos

  • By
    iPhone Click Effect Using MooTools or jQuery

    One thing I love about love about Safari on the iPhone is that Safari provides a darkened background effect when you click a link. It's the most subtle of details but just enforces than an action is taking place. So why not implement that...

  • By
    Flexbox Equal Height Columns

    Flexbox was supposed to be the pot of gold at the long, long rainbow of insufficient CSS layout techniques.  And the only disappointment I've experienced with flexbox is that browser vendors took so long to implement it.  I can't also claim to have pushed flexbox's limits, but...

Discussion

    Wrap your code in <pre class="{language}"></pre> tags, link to a GitHub gist, JSFiddle fiddle, or CodePen pen to embed!