Title: render dynamic csrf hidden input while using cache in yii2
Tags: php;caching;csrf;yii2
Question: I have cached fragment of html including form in my view.
<?php $form = ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0gin(); ?&gt;
<?php echo $form-&gt;field($model, 'name'); ?&gt;
<?= Html75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0submitButton('Save') ?&gt;
<?php ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0nd() ?&gt;
Problem is with CSRF validation token - it should be dynamic (not static). Is there any other / better way how to render it without disabling and enabling it again?
<?php Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;enableCsrfValidation = false; ?&gt;
<?php $form = ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0gin(); ?&gt;
<?php Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;enableCsrfValidation = true; ?&gt;
<input type="hidden" name="_csrf" value="<?php echo $this-&gt;renderDynamic('return Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;csrfToken;'); ?&gt;"&gt;
<?php echo $form-&gt;field($model, 'name'); ?&gt;
<?= Html75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0submitButton('Save') ?&gt;
<?php ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0nd() ?&gt;
If I don't disable &amp; enable CsrfValidation I have two tokens in html - first is from cache and the second one is dynamic.
Comment: you don't have to do this. Have you added csrf meta tags in you layout  main.php file?
and update your composer once

Comment: check your views site login.php page. they are using active form. Check how many csrf token are there. and let me know

Comment: sure I did update everything. If I don't do that I have two hidden _csrf tokens in my form...

Comment: There is only one. But it is because it's not cached - problem is only with duplicated tokens in cached blocks of code - as tokens should be dynamic there (not cached) I have to do this workaround...


Here is another answer: Another way:
<?php $form = ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0gin(['options' =&gt; ['csrf' =&gt; false]]); ?&gt;
<input type="hidden" name="<?= $this-&gt;renderDynamic('return Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;csrfParam;'); ?&gt;" value="<?= $this-&gt;renderDynamic('return Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;csrfToken;'); ?&gt;" /&gt;
<?php ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0nd(); ?&gt;

Here is another answer: I was just running into this same issue and finally after hours of messing around with different things I came up with a way to modify it with jQuery.
$this-&gt;registerJs("$(document).ready(function(){
$('input[name=_csrf]').val('".$this-&gt;renderDynamic('return Yii75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0$app-&gt;request-&gt;csrfToken;')."');
});", View75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0POS_END);
And then get rid of all the extra stuff you have in there
<?php $form = ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0gin(); ?&gt;
<?php echo $form-&gt;field($model, 'name'); ?&gt;
<?= Html75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0submitButton('Save') ?&gt;
<?php ActiveForm75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0nd() ?&gt;

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 2, 'CommentCount': 4, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2014:00:09/08/14', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<php><caching><csrf><yii2>', 'Title': 'render dynamic csrf hidden input while using cache in yii2', 'ViewCount': 2736, 'id': 25723636, 'user_AboutMe': '', 'user_AccountId': 442500.0, 'user_DisplayName': 'emte', 'user_Reputation': 647.0, 'user_Views': 66.0, 'user_id': 833136.0}}