# CSRF Token not work with POST from another site

**URL:** <https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369>\
**Category:** Questions\
**Created:** [June 5, 2016, 4:41pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369 "2016-06-05T16:41:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![herman](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@herman](https://discourse.slimframework.com/u/herman)\
**Post date:** [June 5, 2016, 4:41pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/1 "2016-06-05T16:41:31Z")

</div>

Hello,

I have issue when use CSRF Token and get redirect post from another site (Paypal IPN).  
The IPN notify not work, after i checked this becuase not csrf token not match, and got error 400.

here my example code, for receive POST feedback from Paypal IPN.

> $app-\>post(‘/callback’,function(){  
> // $\_POST \>\> post data from paypal ipn

> });

My current solution is disable the CSRF token for all page. Is there another way to make it work when enable csrf token ?

I use slimphp 2.

thank you

---

<div class="post-metadata">

**Author:** ![llvdl](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/llvdl/32/78_2.png) [@llvdl](https://discourse.slimframework.com/u/llvdl)\
**Post date:** [June 6, 2016, 10:47am UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/2 "2016-06-06T10:47:41Z")

</div>

I haven’t written any Paypal integrations, but I would not expect the request from Paypal to the callback page to include a CSRF token. Disabling CSRF for this specific page seems the logical solution to me.

---

<div class="post-metadata">

**Author:** ![herman](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@herman](https://discourse.slimframework.com/u/herman)\
**Post date:** [June 6, 2016, 2:18pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/3 "2016-06-06T14:18:46Z")

</div>

thanks @llvdl for your reply 🙂

for now, i do not have another solutions.

---

<div class="post-metadata">

**Author:** ![geggleto](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/geggleto/32/11_2.png) [@geggleto](https://discourse.slimframework.com/u/geggleto)\
**Post date:** [June 10, 2016, 1:46pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/4 "2016-06-10T13:46:54Z")

</div>

You will need to disable the CSRF on that route

---

<div class="post-metadata">

**Author:** ![herman](https://avatars.discourse-cdn.com/v4/letter/h/eada6e/32.png) [@herman](https://discourse.slimframework.com/u/herman)\
**Post date:** [June 10, 2016, 7:36pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/5 "2016-06-10T19:36:46Z")

</div>

yes, i made a Middleware to disable this route.

---

<div class="post-metadata">

**Author:** ![AndreiGOiN](https://avatars.discourse-cdn.com/v4/letter/a/c6cbf5/32.png) [@AndreiGOiN](https://discourse.slimframework.com/u/AndreiGOiN)\
**Post date:** [June 27, 2018, 8:52am UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/6 "2018-06-27T08:52:20Z")

</div>

Can you post that Middleware?  
I have same issue …

---

<div class="post-metadata">

**Author:** ![llvdl](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.slimframework.com/llvdl/32/78_2.png) [@llvdl](https://discourse.slimframework.com/u/llvdl)\
**Post date:** [June 27, 2018, 7:31pm UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/7 "2018-06-27T19:31:19Z")

</div>

@AndreiGOiN, you can use route groups and create a route group with the CRSF token middleware and one without. That way you can add routes that should not check CSRF tokens to the route group without the CSRF middleware.

---

<div class="post-metadata">

**Author:** ![AndreiGOiN](https://avatars.discourse-cdn.com/v4/letter/a/c6cbf5/32.png) [@AndreiGOiN](https://discourse.slimframework.com/u/AndreiGOiN)\
**Post date:** [June 28, 2018, 8:11am UTC](https://discourse.slimframework.com/t/csrf-token-not-work-with-post-from-another-site/369/8 "2018-06-28T08:11:43Z")

</div>

Thank you, @llvdl! I chose to modify guard.php because I have only one route without csrf. If I’ll need more, surely I use your advice. Thanks.