Comments on: How to Fix MODx CSRF Error when Using Firefox 3.5

By: Arkh

Arkh — Fri, 28 May 2010 07:51:30 +0000

Wait.
ModX is using the referrer as a way to prevent CSRF ? Are you kidding ?
Is it too hard to do it right with unique random tokens ?

By: .abelafonte

.abelafonte — Wed, 14 Apr 2010 03:05:16 +0000

No, I’ve never had that type of setup, but I’m sure that the error may have something to do with accessing a local site locally.

I assume that you wouldn’t be allowing any external access to this local installation, so you should be good with disabling the feature in the MODx admin.

By: Frank

Frank — Tue, 13 Apr 2010 19:24:02 +0000

Hey, I just installed 1.0.3 locally on my Mac (MAMP 1.84) and the CSRF is back again. The SendRefererHeader was already on 2. So this doesn’t do it for me. I do have a strict M0n0wall protection for my ISP, but this is runs locally! This could mean this CSRF attack came from within? I wonder what the real thing is here, I dont get it.

By: Tibor

Tibor — Wed, 03 Feb 2010 17:26:11 +0000

Firebug disabled & PageSpeed disabled : modx manager works

Firebug enabled & PageSpeed disabled : modx manager does not work

Firebug disabled & PageSpeed enabled (it’s useless, but …) modx manager works

Anyway Firebug is eating too much resource, so I’ll just disable it when it’s not needed

By: Tibor

Tibor — Wed, 03 Feb 2010 17:19:29 +0000

Well this error just happened to me, after I installed Google PageSpeed plugin for Firefox, and then Firebug. As I type this Firebug is not activated yet; so I’ll disable PageSpeed and let you know…

By: Steve

Steve — Sat, 16 Jan 2010 13:02:55 +0000

Thanks for the tip! I actually had my referrers disables from the web developer tool bar, this post saved me a lot of searching and unnecessary trouble!

By: Sal B / @mayhemchaos

Sal B / @mayhemchaos — Mon, 28 Dec 2009 15:06:23 +0000

Nice debugging there Aaron. For awhile I thought you were having a Firefox on Mac issue.

I think that article on Optimizing Firefox came from LifeHacker.

Nice write up either way.