dimns/simplecsrf

Simple CSRF-token class to prevent CSRF attacks. For forms and AJAX requests.

Maintainers

Details

github.com/DimNS/SimpleCSRF

Homepage

Source

Issues

Installs: 381

Dependents: 1

Suggesters: 0

Security: 0

Stars: 1

Watchers: 1

Forks: 1

Open Issues: 0

v2.0.0 2016-07-25 06:43 UTC

Requires

  • php: >=5.3.0

MIT bc28e216cdb7725d14b1688693ce6d440cb55b84

phpcsrf

This package is auto-updated.

Last update: 2024-04-15 02:37:03 UTC

README

Simple CSRF-token class to prevent CSRF attacks

Latest Stable Version Total Downloads License

Requirements

  • PHP 5.3 or higher is required.

Composer installation

  1. Get Composer.
  2. Require SimpleCSRF with php composer.phar require dimns/simplecsrf or composer require dimns/simplecsrf (if the composer is installed globally).
  3. Add the following to your application's main PHP file: require 'vendor/autoload.php';.

Usage with FORM

php

<?php
require 'vendor/autoload.php';

session_start();

// Init class
$csrf = new \DimNS\SimpleCSRF(); // Default session name: csrf_token

// Init class with other session name
$csrf = new \DimNS\SimpleCSRF('my_session_name');

// Getting a token for forms
$csrf_token = $csrf->getToken();

// Checking the token
if ($csrf->validateToken($_POST['_token'])) {
    echo 'Token correct';
} else {
    echo 'Invalid token';
}

html

<form action="index.php" method="post">
    <input type="text" name="login">
    <input type="password" name="password">
    <input type="hidden" name="_token" value="<?=$csrf_token?>">
    <input type="submit" value="GO!">
</form>

Usage with AJAX

php

<?php
require 'vendor/autoload.php';

session_start();

// Init class
$csrf = new \DimNS\SimpleCSRF(); // Default session name: csrf_token

// Init class with other session name
$csrf = new \DimNS\SimpleCSRF('my_session_name');

// Generate a token for forms
$csrf_token = $csrf->getToken();

// Checking the token
if ($csrf->validateToken($_SERVER['HTTP_X_CSRFTOKEN'])) {
    // Token correct
} else {
    // Invalid token
}

html

<head>
    <meta name="_token" content="<?=$csrf_token?>">
</head>

javascript

// jQuery
$.ajaxSetup({
    beforeSend: function (xhr, settings) {
        if (!/^(GET|HEAD|OPTIONS|TRACE)$/i.test(settings.type)) {
            xhr.setRequestHeader("X-CSRFToken", $('meta[name="_token"]').attr('content'));
        }
    }
});