6 Comments

Excuse me,may I ask how to disable CSRF token authentication during login

Expand full comment
author

There's no option to disable CSRF tokens for login. What problem are you trying to solve?

Expand full comment

We have multiple poweradmin to manage, and in older versions, we could achieve one click login to poweradmin without CSRF

Expand full comment
author

Shortly after the release I started to think that it would be good to have a configuration flag, nor is it very good from a security point of view, but anyway I started to look for a possible solution that could be delivered quickly. From another perspective it would be better to design it in a different way, I mean maybe possibility to manage multiple DNS servers from single installation.

Expand full comment

This is also a method, but it may result in the database allowing external access. We only want to keep the database visible internally

Expand full comment
author

OK, I see. Different people, different deployment models. Still a bit wondering how you use it and how this login CSRF protection makes trouble, except there was a problem with insecure (non-SSL) installations, but that was fixed in 3.8.1. Anyway, initial code for your issue is already in master, added two new flags, but had no time to test it properly, still need to make some changes on installer side before next release.

Expand full comment