{"record":{"id":"cbf3e272652c95e3","repo":"Dolibarr/dolibarr","slug":"access-to-this-page-this-way-post-method-or-get-with-a","errorCode":null,"errorMessage":"Access to this page this way (POST method or GET with a sensible value for 'action' parameter) is refused by CSRF protection in main.inc.php. Token not provided.","messagePattern":"Access to this page this way \\(POST method or GET with a sensible value for 'action' parameter\\) is refused by CSRF protection in main\\.inc\\.php\\. Token not provided\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"htdocs/main.inc.php","lineNumber":443,"sourceCode":"\t\tGETPOSTISSET('massaction') ||\n\t\t((GETPOSTISSET('actionlogin') || GETPOSTISSET('action')) && defined('CSRFCHECK_WITH_TOKEN'))\n\t) {\n\t\t// If token is not provided or empty, error (we are in case it is mandatory)\n\t\tif (!GETPOST('token', 'alpha') || GETPOST('token', 'alpha') == 'notrequired') {\n\t\t\ttop_httphead();\n\t\t\tif (GETPOSTINT('uploadform')) {\n\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused. File size too large or not provided.\");\n\t\t\t\t$langs->loadLangs(array(\"errors\", \"install\"));\n\t\t\t\tprint $langs->trans(\"ErrorFileSizeTooLarge\").' ';\n\t\t\t\tprint $langs->trans(\"ErrorGoBackAndCorrectParameters\");\n\t\t\t} else {\n\t\t\t\thttp_response_code(403);\n\t\t\t\tif (defined('CSRFCHECK_WITH_TOKEN')) {\n\t\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused by CSRF protection (CSRFCHECK_WITH_TOKEN protection) in main.inc.php. Token not provided.\", LOG_WARNING);\n\t\t\t\t\tprint \"Access to a page that needs a token (constant CSRFCHECK_WITH_TOKEN is defined) is refused by CSRF protection in main.inc.php. Token not provided.\\n\";\n\t\t\t\t} else {\n\t\t\t\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused by CSRF protection (POST method or GET with a sensible value for 'action' parameter) in main.inc.php. Token not provided.\", LOG_WARNING);\n\t\t\t\t\tprint \"Access to this page this way (POST method or GET with a sensible value for 'action' parameter) is refused by CSRF protection in main.inc.php. Token not provided.\\n\";\n\t\t\t\t\tprint \"If you access your server behind a proxy using url rewriting and the parameter is provided by caller, you might check that all HTTP header are propagated (or add the line \\$dolibarr_nocsrfcheck=1 into your conf.php file or MAIN_SECURITY_CSRF_WITH_TOKEN to 0\";\n\t\t\t\t\tif (getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN')) {\n\t\t\t\t\t\tprint \" instead of \" . getDolGlobalString('MAIN_SECURITY_CSRF_WITH_TOKEN');\n\t\t\t\t\t}\n\t\t\t\t\tprint \" into setup).\\n\";\n\t\t\t\t}\n\t\t\t}\n\t\t\tdie;\n\t\t}\n\t}\n\n\t$sessiontokenforthisurl = (empty($_SESSION['token']) ? '' : $_SESSION['token']);\n\t// TODO Get the sessiontokenforthisurl into an array of session token (one array per base URL so we can use the CSRF per page and we keep ability for several tabs per url in a browser)\n\tif (GETPOSTISSET('token') && GETPOST('token') != 'notrequired' && GETPOST('token', 'alpha') != $sessiontokenforthisurl) {\n\t\tdol_syslog(\"--- Access to \".(empty($_SERVER[\"REQUEST_METHOD\"]) ? '' : $_SERVER[\"REQUEST_METHOD\"].' ').$_SERVER[\"PHP_SELF\"].\" refused by CSRF protection (invalid token), so we disable POST and some GET parameters - referrer=\".(empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER']).\", action=\".GETPOST('action', 'aZ09').\", _GET|POST['token']=\".GETPOST('token', 'alpha'), LOG_WARNING);\n\t\t//dol_syslog(\"_SESSION['token']=\".$sessiontokenforthisurl, LOG_DEBUG);\n\t\t// Do not output anything on standard output because this create problems when using the BACK button on browsers. So we just set a message into session.\n\t\tif (!defined('NOTOKENRENEWAL')) {","sourceCodeStart":425,"sourceCodeEnd":461,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L425-L461","documentation":"The generic CSRF refusal in main.inc.php: a state-changing request (POST, or GET with a meaningful 'action' parameter) arrived without a token on a page that did not declare CSRFCHECK_WITH_TOKEN. Dolibarr returns 403 to prevent cross-site request forgery.","triggerScenarios":"POST to any main.inc.php-protected page without token parameter; GET request with action=add/confirm/update etc. and no token; external form or curl script posting into Dolibarr endpoints.","commonSituations":"REST/curl scripts posting to page endpoints instead of the REST API; embedding Dolibarr forms in third-party sites; session regenerated (login) making the old token invalid; load-balanced setup with mismatched sessions.","solutions":["Include the token: POST field or GET 'token' parameter from newToken() matching the current session","Use Dolibarr's REST API (api token) for programmatic access instead of form endpoints","Ensure the user session is active and stable (same Dolibarr instance) when the form is submitted","As a last resort, tune MAIN_SECURITY_CSRF_WITH_TOKEN (not recommended) or set $dolibarr_nocsrfcheck in conf.php for trusted contexts"],"exampleFix":"// before\ncurl -d 'action=update&id=15' https://doli.example.com/htdocs/societe/card.php\n// after\ncurl -d 'action=update&id=15&token='$TOKEN https://doli.example.com/htdocs/societe/card.php","handlingStrategy":"fallback","validationCode":"if (($_SERVER['REQUEST_METHOD']==='POST' || isset($_GET['action'])) && empty($_REQUEST['token'])) { die('Token required before calling Dolibarr'); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always append token='.newToken() to action URLs and add the token field to POST forms","Use the REST API (DOLAPIKEY) for scripts instead of form endpoints","Keep the browser session alive between rendering and submitting forms","After login/logout the old token is invalid — refetch the page"],"tags":["csrf","dolibarr","security","token"],"backgroundTag":"authentication-required","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}