I'm implementing a plugin and I need to process a POST parameter generated by a 3rd party service in a view.

I have 2 alternatives:

- Process it in the authentication view.

Problem: CSRF issues since this view request a CSRF Token that the IdP ignores. Disable this check on the authentication login is not possible due security implications.


- Process it in a public view.

Problem: Right now I don't know how to create at the plugin an action where non logged users can access without being redirected to login view.

Can anyone share how create a such public action?

Hi,

I believe the unsecureRequest event could fit what you need, but to be honest, I don't remember an example of usage...

I use www.limesurvey.org/manual/NewUnsecureRequest to extend remote control.

For redirection : code sample : gitlab.com/SondagesPro/ExportAndStats/qu...AndStat.php#L446-449