[security] Add CSRF token check #37

New Issue

mia · 2019-02-23T06:26:01+01:00

mia commented

2019-02-23 06:26:01 +01:00

CSRF check is important to protect webapps.

Webpage:

	1. send a session cookie
		$_SESSION['csrf'] = {random_generated_value};
	2. include the token to webpage's <FORM> ~ </FORM> area
		<input type="hidden" name="csrf" value="{random_generated_value}">

When the user POST data:

	if ($_POST['csrf'] != $_SESSION['csrf']) {
		echo('CSRF token mismatch!');
		$_SESSION['csrf'] = {random_generated_value};// send new value
		exit;
	}

CSRF check is important to protect webapps. ``` Webpage: 1. send a session cookie $_SESSION['csrf'] = {random_generated_value}; 2. include the token to webpage's <FORM> ~ </FORM> area <input type="hidden" name="csrf" value="{random_generated_value}"> When the user POST data: if ($_POST['csrf'] != $_SESSION['csrf']) { echo('CSRF token mismatch!'); $_SESSION['csrf'] = {random_generated_value};// send new value exit; } ```

albino commented

2019-02-24 17:50:47 +01:00

We have this already :-)

[We have this already](https://git.fuwafuwa.moe/.cyb/cyberman/issues/9) :-)

albino closed this issue

2019-02-24 17:50:47 +01:00

Sign in to join this conversation.

No Label