```php
public $enableCsrfValidation = false;
```

To my XYZController.
It's not safe to do it, but it worked, I'm using different controllers just for IPN, so it's fine.
 
 
Or just add this code in your controller so you can easily disable CSRF
 
 
 
 
```php 
public function beforeAction($action) 
 
{
 
if(Yii::$app->controller->action->id=="ipn")
 
$this->enableCsrfValidation = false;
 
return parent::beforeAction($action);
 
}
 
```
 
 
 
 

Read more here: [Yii Forum]( http://www.yiiframework.com/forum/index.php/topic/21146-yii-and-paypal-ipn-400-bad-request-via-ipn-simulator/page__gopid__268890#entry268890 " http://www.yiiframework.com/forum/index.php/topic/21146-yii-and-paypal-ipn-400-bad-request-via-ipn-simulator/page__gopid__268890#entry268890")