banujan6/csrf-handler

A simple CSRF Token protection library for PHP. I t will help you to generate the random unique token and validate it to prevent CSRF attack.

[DEPRECATED] CSRF-Handler

CSRF protection class file for PHP.

Bye Bye, Version 1.0!
We released version 2 with better implementation. :)

Please Note: We no longer maintain this project. Please Consider using PHP Frameworks for better built-in security.

Functions

Function	Description
get()	Validate CSRF only for GET requests
post()	Validate CSRF only for POST requests
all()	Validate CSRF for GET & POST requests
token()	Generate CSRF Token
flushToken()	Remove all tokens

Installation

Via Composer

Require the package.

	composer require banujan6/csrf-handler

Use namespace & class.

	<?php
		//If you are using any frameworks, It will load autoload.php automatically. So you don't need.
		require_once __DIR__ . '/../../vendor/autoload.php';
		use csrfhandler\csrf as csrf;
	?>

Including File

Download the csrf.php file in directory src. Then include it in your PHP file.

<?php 
  require_once("path/csrf.php");
  use csrfhandler\csrf as csrf;
?>

Usages

This CSRF-Handler will look for a form-data / url-parameter called _token. To verify the request, POST request need to have a _token in form-data. And GET request need to have a _token in url-parameter.

Generating Token

<form>
  <input type="hidden" name="_token" value="<?php echo csrf::token(); ?>">
</form>

Validating Request

GET Request Only

  $isValid = csrf::get(); // return TRUE or FALSE
  
  if ( $isValid ) {
  
    //Do something if valid
  
  } else {
  
    //Do something if not vaid
  
  }

POST Request Only

  $isValid = csrf::post(); // return TRUE or FALSE
  
  if ( $isValid ) {
  
    //Do something if valid
  
  } else {
  
    //Do something if not vaid
  
  }

GET & POST Request

  $isValid = csrf::all(); // return TRUE or FALSE
  
  if ( $isValid ) {
  
    //Do something if valid
  
  } else {
  
    //Do something if not vaid
  
  }

Clear All Active Tokens

  csrf::flushToken(); // will destroy all active tokens

Examples

You can find basic examples in example/ directory.

License

Licensed under MIT

csrf-handler's Issues

Add checks for user agent and IP address

To increase security there should be additional checks for user agent and IP address. Doing so a token is linked to the current browser and IP address which makes it more difficult to fake it and to use it in other application.

However, I do not recommend to save those information in plain text but rather would like to see them hashed for privacy reasons.

Ajax request

Hello, how can i implement this CSFR-handler inside ajax requst ?

Currently i have MVC framework when load VIEW it generates token and when i want to edit it is working fine (first time because CSFR tokens are the same) but next time without refresh i get error - i understand where is the problem so if you can help ?

Thank you in advance...

PHP version

If you want to avoid loading the page a bit long

In the CSRF file you can annotate the code below:

Its keeps your script from looking for nothing.

//if (phpversion() < 5.5)
{
$hashedToken = hash('sha256', base64_encode($keySet.$userAgent.$clientIp));
}
/*else
{
$hashedToken = base64_encode(password_hash(base64_encode($keySet.$userAgent.$clientIp), PASSWORD_BCRYPT));
}*/

Thanks

Available on Composer?

Possible to get this repository listed at https://packagist.org so we can install it via Composer?

Undefined index: X-CSRF-TOKEN-LIST

Hello,
first want to thank you for your great CSRF handler...

I have problem with

Undefined index: X-CSRF-TOKEN-LIST in vendor/banujan6/csrf-handler/src/csrfhandler/csrf.php on line 71

• on that line is setToken function and if i putt

$_SESSION['X-CSRF-TOKEN-LIST'] = null;

There is no error,but $_SESSION['X-CSRF-TOKEN-LIST'] is different "shorter" - is this ok or ?

array_push() expects parameter 1 to be array, boolean given

I was getting this error in my source code:
array_push() expects parameter 1 to be array, boolean given in csrf.php on line 61

I changed:
$tokenList = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);

To this:
$tokenList[] = unserialize($_SESSION['X-CSRF-TOKEN-LIST']);

And the error went away.

"Class 'csrf' not found"

Hi @banujan6 ,

I added it with Composer but I get an error. What could be the reason for this?

Error
Class 'csrf' not found

use csrfhandler\csrf as csrf;
	$isValidCSRF = csrf::all();

PHP 7.3
Thank you.

Hello, @banujan6 i have just seen your update but there is another problem, thing that you need patched

Hello, @banujan6 i have just seen your update but there is another problem, thing that you need patched

private static function startSession() { if(!isset($_SESSION["X-CSRF-TOKEN-LIST"]) && session_status() == PHP_SESSION_NONE){ session_start(); } $_SESSION["X-CSRF-TOKEN-LIST"] = null; // initializing the index }

If somebody has session class on there own, without this it will show "notice" that session already started - also i have moved your $_SESSION["X-CSRF-TOKEN-LIST"] out off IF loop :)

Originally posted by @onebeat in #7 (comment)

self::removeToken()

Is it necessary add self::removeToken() in checkToken()?
I submit form via ajax, the first time is true but false in second because token was removed.

jquery $.post and token validation issue

Hi,

If I try this methos, I got token issue. Simple php->php page change is working.
This is my example code.

In index.php:

use csrfhandler\csrf as csrf;
$_token = csrf::token();

<script>
var token = '<?php echo $_token; ?>';
var chk = new Object();
chk._token = token;
$.post("_checkProduct.php", chk, function(chkProduct){
  alert(chkProduct.found);
}, "json");
</script>

In _checkProduct.php:

use csrfhandler\csrf as csrf;
$ret = array();
if (csrf::post()) {
  $ret["found"] = "token ok";
} else {
  $ret["found"] = "token issue!";
}
echo json_encode($ret);

If I load the index.php I got the "token issue!" alert box. Id don't know why, if I send back the token into alert() box, the 2 token is same.

Thx