I've headed this issue off before, but now I think I know why it happens.

The problem

With a new install of Zend Server on my Mac and trying to access a DB with my Zend Framework web app I am greeted with an error of

Message: SQLSTATE[HY000] [2002] Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)" when trying to run our application.

This was rather frustrating as I changed all instances of mysql_default_socket in the PHP settings (php.ini). It still didn't pick up the location of the socket. Since I'm using PDO, it looks like this is an issue in PHP 5.2 for PDO.

http://forums.zend.com/viewtopic.php?f=44&t=568

The work around for me has been to declare the socket in my application.ini file

resources.db.params.unix_socket = "/usr/local/zend/mysql/tmp/mysql.sock"

The problem this introduces, haveing a different application.ini on the server and on then on my local devel machine.

Ugggg.

Zend Framework Form Hash Ajax

This one sucked hunting down the answer.

The problem. I would include a token (hash) in the form I was producing. I set the form as a checkbox that as soon as it's checked it fires off an AJAX request with the token, and data. The first time it worked great, every other time it would tell me the Token was missing. Hmmmm....

http://codeutopia.net/blog/2008/10/16/how-to-csrf-protect-all-your-forms...

Hi Jani, I got a work around for the problem. The real problem is this, for AJAX requests, it works for first time and not for the subsequent requests. The AJAX request was having the same token for all it’s requests but the plugin was generating unique token for all the requests. So is the mismatch / problem. That was the problem.
Workaround:
What I did was, for each AJAX request, I stopped generating a new token and used the already generated one to compare. So by this way I can cover for multiple AJAX requests. It could be vulnerable for the time that it lives and after that I will eject (logout) the user from the system and then they (attacker) will have to login again and get a token and then attack (if they wanted to really). That was it.

I never did find an answer yet, I did post it to StackOverFlow
http://stackoverflow.com/questions/2474774/how-to-use-zend-framework-for...

Instead I did the whole thing manually..

Form

class Form_GroupListForm extends Zend_Form
{
    public function  __construct($options = null)
    {
        parent::__construct($options);
 
        $this->setName('grouplist');
 
        $groupmodel = new Default_Model_Group();
 
        $groups = new Zend_Form_Element_MultiCheckbox('groups');
        $groups->addMultiOptions($groupmodel->getGroupList())
               ->setLabel('Groups')
               ->setDescription('Groups this person belongs to:')
               ->setAttrib('class', 'ajaxcheckbox')
                ;
 
        $token = new Zend_Form_Element_Hash('grouplisttoken');
        $token->setSalt('hello')
              ->setTimeout(3600)    // Form times out after one hour
              ->removeDecorator('HtmlTag')
              ->removeDecorator('Label');
 
 
        $myNamespace = new Zend_Session_Namespace('authtoken');
        $myNamespace->authtoken = $hash = md5(time());
        $auth = new Zend_Form_Element_Hidden('authtoken');
        $auth->setValue($hash)
             ->setRequired('true')
              ->removeDecorator('HtmlTag')
              ->removeDecorator('Label');
 
 
 
        $this->addElements(array($groups, $auth));
 
 
    }
}

Notice the session being generated then stored as a hidden field. Dumb that I have to basically replicate the hash feature, but the hash has an hop of 1, meaning that it can only be used for one page refresh then it expires. There should be a way to persist this token over several ajax calls.