Created
July 9, 2015 09:12
-
-
Save kwizzn/4d9e48c992a7f4e9d34b to your computer and use it in GitHub Desktop.
Simple PHP CSRF form protection demo
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| function storeCsrfInSession($key, $value) { | |
| if (isset($_SESSION)) { | |
| $_SESSION[$key] = $value; | |
| } | |
| } | |
| function removeCsrfFromSession($key) { | |
| $_SESSION[$key] = ' '; | |
| unset($_SESSION[$key]); | |
| } | |
| function cleanPreviousCsrfs($name) { | |
| foreach($_SESSION as $key => $val) { | |
| if (substr($key, 0, strlen($name))) { | |
| $_SESSION[$key] = ' '; | |
| unset($_SESSION[$key]); | |
| } | |
| } | |
| } | |
| function getCsrfFromSession($key) { | |
| if (isset($_SESSION[$key])) { | |
| return $_SESSION[$key]; | |
| } | |
| else { | |
| return false; | |
| } | |
| } | |
| function generateCsrfToken($formName) | |
| { | |
| if (function_exists('hash_algos') && in_array('sha512', hash_algos())) { | |
| $token = hash('sha512', mt_rand(0, mt_getrandmax())); | |
| } else { | |
| $token = ' '; | |
| for ($i = 0; $i < 128; ++$i) { | |
| $r = mt_rand(0, 35); | |
| if ($r < 26) { | |
| $c = chr(ord('a') + $r); | |
| } else { | |
| $c = chr(ord('0') + $r - 26); | |
| } | |
| $token .= $c; | |
| } | |
| } | |
| $key = $formName . '_' . mt_rand(0,mt_getrandmax()); | |
| cleanPreviousCsrfs($formName); | |
| storeCsrfInSession($key, $token); | |
| return array('name' => $key, 'token' => $token); | |
| } | |
| function validateCsrfToken($formName, $tokenValue) | |
| { | |
| $token = getCsrfFromSession($formName); | |
| if ($token === false) { | |
| return false; | |
| } elseif ($token === $tokenValue) { | |
| $result = true; | |
| } else { | |
| $result = false; | |
| } | |
| removeCsrfFromSession($formName); | |
| return $result; | |
| } | |
| session_start(); | |
| if (count($_POST) > 0) { | |
| $valid = validateCsrfToken($_POST['csrfName'], $_POST['csrfToken']); | |
| if ($valid) { | |
| echo '<h1>CONTINUE DUDE.</h1>'; | |
| // Do stuff | |
| } else { | |
| echo '<h1>NO WAY DUDE!</h1>'; | |
| } | |
| } else { | |
| $csrf = $token=generateCsrfToken('myForm'); | |
| ?> | |
| <form action="" method="POST"> | |
| <input type="hidden" name="csrfName" value="<?php echo $csrf['name'] ?>"> | |
| <input type="hidden" name="csrfToken" value="<?php echo $csrf['token'] ?>"> | |
| <input type="email" name="email" placeholder="Email"> | |
| <button type="submit">Submit</button> | |
| </form> | |
| <?php | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment