php - Set config item (csrf) doesnt work in Codeigniter -

i want turn on csrf protection in few of controllers, have

function __construct() {      parent::__construct();     $this->load->library('form_validation');             $this->load->library('tank_auth');     $this->load->helper(array('form', 'url'));     $this->load->model('user_model', '', true);      $this->config->set_item('csrf_protection', true);  } 

but doesn't seem work, although when var_dump($this->config) on page shows csrf_protection true, cookies not set , form has hidden field without value

<input type="hidden" name="ci_csrf_token" value="" />

csrf token name , cookie name set, forms called form_open().

any appreciated.

update: not possible version 2.1.1 because of line in security class construct if (config_item('csrf_protection') === true) {

security class initialized before controller, natural config item change in controller not affect it.

i have solution you. create custom application/core/my_security.php , put in it:

<?php if ( !defined( 'basepath' ) ) exit( 'no direct script access allowed' );  class my_security extends ci_security {     public function csrf_verify( )     {         foreach ( config_item('csrf_excludes') $exclude )         {             $uri = load_class('uri', 'core');             if ( preg_match( $exclude, $uri->uri_string() ) > 0 )             {                 // still input filtering prevent parameter piggybacking in form                 if (isset($_cookie[$this->_csrf_cookie_name]) && preg_match( '#^[0-9a-f]{32}$#is', $_cookie[$this->_csrf_cookie_name] ) == 0)                 {                     unset( $_cookie[$this->_csrf_cookie_name] );                 }                 return;             }         }         parent::csrf_verify( );     } } 

this check following excludes need put in application/config.php in csrf section:

$config['csrf_excludes'] = array     ( '@^/?excluded_url_1/?@i'     , '@^/?excluded_url_2/?@i' ); 

every matching url pattern excluded csrf checks. can build regex here @ http://rubular.com

cheers