# Just noticed that my CSRF protection didn't work

**URL:** <https://discourse.slimframework.com/t/just-noticed-that-my-csrf-protection-didnt-work/462>\
**Category:** Questions\
**Created:** [July 1, 2016, 3:25pm UTC](https://discourse.slimframework.com/t/just-noticed-that-my-csrf-protection-didnt-work/462 "2016-07-01T15:25:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![johan](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@johan](https://discourse.slimframework.com/u/johan)\
**Post date:** [July 1, 2016, 3:25pm UTC](https://discourse.slimframework.com/t/just-noticed-that-my-csrf-protection-didnt-work/462/1 "2016-07-01T15:25:11Z")

</div>

Hi!

When DI

```php
$container['csrf'] = function ($container) {
    return new \Slim\Csrf\Guard;
};

```

It works. I get a “Failed CSRF check!”

But when trying to throw a “Method not allowed” response with

```php
$container['csrf'] = function ($container) {
    $guard = new \Slim\Csrf\Guard();
    $guard->setFailureCallable(function ($request, $response, $next) {
        $request = $request->withAttribute("csrf_status", false);
        return $next($request, $response);
    });
    return $guard;
};

```

It seems that i have broken the CSRF protection.

And to test the CSRF I’m using this snipp:

```auto
<html><body>

  <form name="csrf_form" action="http://VULNERABLE_APP/csrf.php" method="POST">
    <input type="hidden" name="csrf_param" value="POST_ATTACK">
  </form>

  <script type="text/javascript">document.csrf_form.submit();</script>
</body></html>

```

How do I throw a method not allow on CSRF failure?

---

<div class="post-metadata">

**Author:** ![JoeBengalen](https://avatars.discourse-cdn.com/v4/letter/j/b5e925/32.png) [@JoeBengalen](https://discourse.slimframework.com/u/JoeBengalen)\
**Post date:** [July 1, 2016, 3:56pm UTC](https://discourse.slimframework.com/t/just-noticed-that-my-csrf-protection-didnt-work/462/2 "2016-07-01T15:56:37Z")

</div>

Do you use the attribute `csrf_status` anywhere?

The default failure handler returns an errro for you, but with the fail handler you use you will have to return an error yourself.

Check below the default failure handler

> <https://github.com/slimphp/Slim-Csrf/blob/master/src/Guard.php#L314>