crodas / csrf-token
Easier way to generate CSRF tokens
v1.0.0
2015-12-25 21:42 UTC
This package is auto-updated.
Last update: 2024-10-12 19:28:12 UTC
README
Stateless CSRF-token generation and verification.
Instalation
composer require crodas/csrf-token:"^1.0"
Properties
- Hashes are unique per IP
- They require a site secret, so hashes are impossible to forge.
- Hashes expires after a certain amount of time (Default: 1 hour)
How to use it
Initialize the library:
require __DIR__ . '/vendor/autoload.php'; CSRF::setSecret($strong_secret_key);
Add it to your forms
<input type="hidden" name="_csrf" value="<?php echo CSRF::generate() ?>" />
And then verify the hashes are legit and still valid:
if (empty($_POST['_csrf']) || !CSRF::verify($_POST['_csrf'])) { throw new Exception("CSRF Token is invalid"); }