Craft CSRF protection and Facebook Tab I have a Craft 3 installation and want to add a tab/app to Facebook like domain.com/facebook

Facebook sends a post request to the configured secure tab URL. Now when Craft's CSRF protection is enabled, Craft gives an error. If I disable CSRF protection the tab shows up in Facebook.

I don't want to disable CSRF - what could i do... plugin with a controller to render the template?
You can disable the token for a certain controller via 

use Craft;
...
Yii::$app-&gt;controller-&gt;enableCsrfValidation = false;


or inside a Controller for a certain request

/**
 * @inheritdoc
 */
public function beforeAction($action)
{            
    if ($action-&gt;id == 'my-method') {
        $this-&gt;enableCsrfValidation = false;
    }

    return parent::beforeAction($action);
}


Take a look at $enableCsrfValidation property of yii\web\Controller.