Ttdfjt

I have a custom module with a defined route as:

<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
 <router id="standard">
 <route id="custom_module" frontName="custom-module">
 <module name="Custom_Module" />
 </route>
 </router>
</config>

With previous versions of Magento both GET and POST requests would work fine to http://mywebsite.com/custom-module/controllername

After upgrading to Magento 2.3.0, GET requests still work as before, however POST requests now do not call the execute() method of the controller. Instead, they respond with a 200 OK and a response body that is the homepage html of the website.

Does this have to do with some Csrf security feature and form keys that was added in v2.3?

Found the solution, your controller must implement CsrfAwareActionInterface and 2 of its methods:

use MagentoFrameworkAppCsrfAwareActionInterface;
use MagentoFrameworkAppRequestInterface;
use MagentoFrameworkAppRequestInvalidRequestException;

class MyController extends MagentoFrameworkAppActionAction implements CsrfAwareActionInterface

 public function createCsrfValidationException(RequestInterface $request): ?InvalidRequestException
 
 return null;
 

 public function validateForCsrf(RequestInterface $request): ?bool
 
 return true;
 

This solves the problem, but is also backwards incompatible, i.e. your module will now not work on Magento 2.2 and earlier. To make it backwards compatible, something like the following is needed:

use MagentoFrameworkAppCsrfAwareActionInterface;
use MagentoFrameworkAppRequestInterface;
use MagentoFrameworkAppRequestInvalidRequestException;

if (interface_exists("MagentoFrameworkAppCsrfAwareActionInterface"))
 include __DIR__ . "/MyController.m230.php";
else
 include __DIR__ . "/MyController.m220.php";

Where you would have the full and correct class declaration in each of the two files.

Please check more generous solution that does not change core functionality, you can use around plugin on Validate function of MagentoFrameworkAppRequestCsrfValidator class

This implementation does not break the core functionality of Magento 2.1/2.2/2.3 versions.

di.xml

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
 <type name="MagentoFrameworkAppRequestCsrfValidator">
 <plugin name="csrf_validator_skip" type="ModuleVendorPluginCsrfValidatorSkip" />
 </type>
</config>

CsrfValidatorSkip.php

<?php
namespace ModuleVendorPlugin;
class CsrfValidatorSkip

 /**
 * @param MagentoFrameworkAppRequestCsrfValidator $subject
 * @param Closure $proceed
 * @param MagentoFrameworkAppRequestInterface $request
 * @param MagentoFrameworkAppActionInterface $action
 */
 public function aroundValidate(
 $subject,
 Closure $proceed,
 $request,
 $action
 ) 
 if ($request->getModuleName() == 'Your_Module_frontName_Here') 
 return; // Skip CSRF check
 
 $proceed($request, $action); // Proceed Magento 2 core functionalities
 

Please star me at https://gist.github.com/ananth-iyer/59ecfabcbca73d6c2e3eeb986ed2f3c4#file-csrfvalidatorskip-php-L9 to encourage.

One could provide a compatible solution to PHP 7.1< & Mage 2.3< if they were to outsource the validator to a different class, e.g.

if (PHP_VERSION_ID < 70100) 
 class Index extends ExtendableMain 
 else 
 class Index extends ExtendableCsrCompatible 

Where ExtendableMain has the logic for execute() and CsrCompatible can both extend ExtendableMain and implements CsrfAwareActionInterface. E.g:

class Main extends Action 

 execute() ...

And

class CsrCompatible extends Main implements CsrfAwareActionInterface 

 //interface functions

The 5.6-7.0 will just never go into the CsrCompatible and therefore not throw an exception when it sees the fancy ?bool code.

Implement CsrfAwareActionInterface is a solution, but it makes the code not compatible with Magento < 2.3

Here is a trick (injecting the Key to the request on the Action) that is compatible with Magento 2.X

Put it in the constructor of the Action.

 // CsrfAwareAction Magento2.3 compatibility
 if (interface_exists("MagentoFrameworkAppCsrfAwareActionInterface")) 
 $request = $this->getRequest();
 if ($request instanceof HttpRequest && $request->isPost() && empty($request->getParam('form_key'))) 
 $formKey = $this->_objectManager->get(MagentoFrameworkDataFormFormKey::class);
 $request->setParam('form_key', $formKey->getFormKey());