Aplus Framework Docs

AntiCSRF
in package

Class AntiCSRF.

Tags
see
https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern
see
https://stackoverflow.com/q/6287903/6027968
see
https://portswigger.net/web-security/csrf
see
https://www.netsparker.com/blog/web-security/protecting-website-using-anti-csrf-token/

Table of Contents

$enabled  : bool
$request  : Request
$tokenName  : string
$verified  : bool
__construct()  : mixed
AntiCSRF constructor.
disable()  : static
Disables the Anti CSRF verification.
enable()  : static
Enables the Anti CSRF verification.
getToken()  : string|null
Gets the anti-csrf token from the session.
getTokenName()  : string
Gets the anti-csrf token name.
getUserToken()  : string|null
Gets the user token from the request input form.
input()  : string
Gets the HTML form hidden input if the verification is enabled.
isEnabled()  : bool
Tells if the verification is enabled.
isSafeMethod()  : bool
Safe HTTP Request methods are: GET, HEAD and OPTIONS.
setToken()  : static
Sets the anti-csrf token into the session.
setTokenName()  : static
Sets the anti-csrf token name.
validate()  : bool
Validates if a user token is equals the session token.
verify()  : bool
Verifies the request input token, if the verification is enabled.
isVerified()  : bool
setVerified()  : static

Properties

$tokenName

protected string $tokenName = 'csrf_token'

$verified

protected bool $verified = false

Methods

__construct()

AntiCSRF constructor.

public __construct(Request $request) : mixed
Parameters
$request : Request
Return values
mixed

getToken()

Gets the anti-csrf token from the session.

public getToken() : string|null
Return values
string|null

getTokenName()

Gets the anti-csrf token name.

public getTokenName() : string
Return values
string

getUserToken()

Gets the user token from the request input form.

public getUserToken() : string|null
Return values
string|null

input()

Gets the HTML form hidden input if the verification is enabled.

public input() : string
Return values
string

isSafeMethod()

Safe HTTP Request methods are: GET, HEAD and OPTIONS.

public isSafeMethod() : bool
Return values
bool

setToken()

Sets the anti-csrf token into the session.

public setToken([string|null $token = null ]) : static
Parameters
$token : string|null = null

A custom anti-csrf token or null to generate one

Return values
static

setTokenName()

Sets the anti-csrf token name.

public setTokenName(string $tokenName) : static
Parameters
$tokenName : string
Return values
static

validate()

Validates if a user token is equals the session token.

public validate(string $userToken) : bool

This method can be used to validate tokens not received through forms. For example: Through a request header, JSON, etc.

Parameters
$userToken : string
Return values
bool

verify()

Verifies the request input token, if the verification is enabled.

public verify() : bool

The verification always succeed on HTTP GET, HEAD and OPTIONS methods. If verification is successful with other HTTP methods, a new token is generated.

Return values
bool

isVerified()

protected isVerified() : bool
Return values
bool

setVerified()

protected setVerified([bool $status = true ]) : static
Parameters
$status : bool = true
Return values
static

Search results