Search by

aleksandarz / csrfmodule

AleksandarZ

A simple CSRF protection module for PHP that stores tokens in a MySQL database.

Package info

github.com/aleksandar-zivanovic/csrf_module

pkg:composer/aleksandarz/csrfmodule

Security

Advisories: 0

Aikido package health analysis

Transparency log

Statistics

Installs: 5

Dependents: 0

Suggesters: 0

Stars: 0

Open Issues: 0

v3.0.0 2026-09-20 00:31 UTC

Requires

  • php: ^8.2

Requires (Dev)

Suggests

None

Provides

None

Conflicts

None

Replaces

None

MIT af10971eabd12cfedbb4e176e4d329c38b623635

  • Aleksandar Zivanovic <acas_mail.woop@yahoo.com>

phpsecuritymysqltokencsrfprotectionphp-librarycsrf-protection

Published on Packagist.org on 2026-09-20 00:40 UTC

This package is auto-updated.

Last update: 2026-09-20 01:05:12 UTC

README

Description

This module provides functionality to generate and validate CSRF tokens. It ensures protection against CSRF attacks by verifying that requests originate from trusted sources.

Current Version: 3.0.0 - see CHANGELOG.md for release history.

Security notice: every version before 3.0.0 accepted any request as valid, because the token submitted with the form was never compared with the stored one. Those versions must not be used.

Features

  • Token generation and validation.
  • Custom expiration time for tokens.
  • Single-use tokens: a token is accepted once and never again.
  • Optional storage of token status (valid, used, expired).
  • Index creation and removal for the status, timestamp and user_id columns, and for the combination of status and timestamp.
  • Cleanup of expired tokens, and of a user's tokens during logout.
  • CSRF protection for anonymous (unauthenticated) users, stored entirely in the session - no database required.

Choose your installation

The module comes in two setups. Both protect any form, whether the visitor is logged in or not, and they differ only in where the tokens are kept (database or session).

Installation with a database - tokens are stored in a MySQL table, one row per token, and the module can list them, mark them as used or expired, limit how many a user may hold at once, and clean them up from a scheduled job. This setup includes the session-only protection as well.

Installation guide: INSTALLATION_DATABASE.md

Installation without a database - tokens are kept in the session only. No database, no user_id, nothing written to disk, and only five files of the module are used. Suitable for applications that need CSRF protection without a database behind it.

Installation guide: INSTALLATION_ANONYMOUS.md

Both guides are self-contained: each one covers installation, configuration and usage for its setup.

Requirements

  • PHP 8.2 or newer
  • An active PHP session
  • MySQL and the pdo_mysql extension, for the installation with a database

License

This project is licensed under the MIT License - see the LICENSE file for details.