PHP CSRF Guard - Revision history

Sarciszewski: Modern PHP: Don't use mt_rand(), use random_bytes() (also, hash_equals())

2016-05-19T12:53:52Z

Modern PHP: Don't use mt_rand(), use random_bytes() (also, hash_equals())

2016-05-18T20:06:11Z

2014-08-07T00:28:30Z

Added contribution

2014-08-07T00:27:17Z

Fixed CSRF bypass

2014-06-30T12:49:00Z

2013-10-23T19:52:13Z

2013-10-23T19:51:33Z

adding double quotes for "csrfguard_inject" to prevent: Notice: Use of undefined constant csrfguard_inject - assumed 'csrfguard_inject'

2012-12-08T00:08:42Z

‎Author and License: list of flaw reporters added

2012-12-08T00:01:46Z

fixed a bug on empty tokens

2012-12-07T23:59:57Z

added caution do not copy paste

@@ Line 31: / Line 31: @@
   function csrfguard_generate_token($unique_form_name)
+  {
-  	if (function_exists("hash_algos") and in_array("sha512",hash_algos()))
+  	$token = random_bytes(64); // PHP 7, or via paragonie/random_compat
   	store_in_session($unique_form_name,$token);
   	return $token;
@@ Line 57: / Line 37: @@
   function csrfguard_validate_token($unique_form_name,$token_value)
+  {
-  	$token=get_from_session($unique_form_name);
+  	$token = get_from_session($unique_form_name);
-  	if ($token===false)
+  	if (!is_string($token_value)) {
+		return false;
+  	}
-  	else
+  	$result = hash_equals($token, $token_value);
   	unset_session($unique_form_name);
   	return $result;
@@ Line 111: / Line 83: @@
   		if (!csrfguard_validate_token($name, $token))
+  		{
-  			trigger_error("Invalid CSRF token.",E_USER_ERROR);
+  			throw new Exception("Invalid CSRF token.");
+  		}
+  	}

← Older revision		Revision as of 20:06, 18 May 2016
Line 1:		Line 1:
		+	{{taggedDocument}}
	=Code Snippet=		=Code Snippet=
		+
	'''CAUTION:''' This code snippet below is segmented intentionally. You are not supposed to copy paste this code, unless you understand its risks and how it operates. It is not verified by OWASP professional, just composed by them. Up until now two small flaws have been reported and fixed in this code. Also it uses regular expressions which are not even close to a good solution for parsing HTML ([http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags see why]), it is just there to give you an insight on what should be done. See the discussion page for more details.		'''CAUTION:''' This code snippet below is segmented intentionally. You are not supposed to copy paste this code, unless you understand its risks and how it operates. It is not verified by OWASP professional, just composed by them. Up until now two small flaws have been reported and fixed in this code. Also it uses regular expressions which are not even close to a good solution for parsing HTML ([http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags see why]), it is just there to give you an insight on what should be done. See the discussion page for more details.

← Older revision		Revision as of 00:28, 7 August 2014
Line 147:		Line 147:
	This piece of code is by [mailto:abbas.naderi@owasp.org Abbas Naderi Afooshteh] from OWASP under Creative Commons 3.0 License.		This piece of code is by [mailto:abbas.naderi@owasp.org Abbas Naderi Afooshteh] from OWASP under Creative Commons 3.0 License.

−	Contributions from Krzysztof Kotowicz <krzysztof.kotowicz at securing.pl>, Jakub Kałużny <jakub.artur.kaluzny at g>	+	Contributions from Krzysztof Kotowicz <krzysztof.kotowicz at securing.pl>, Jakub Kałużny <jakub.artur.kaluzny at g>, Nick Le Mouton <nick at noodles.net dot nz>

@@ Line 24: / Line 24: @@
   		return $_SESSION[$key];
+  	}
-  	else {  return false; } //no session data, no CSRF risk
+  	else {  return false; }
+  }
@@ Line 58: / Line 58: @@
   	if ($token===false)
+  	{
-  		return true;
+  		return false;
+  	}
   	elseif ($token===$token_value)

@@ Line 20: / Line 20: @@
   function get_from_session($key)
+  {
-  	if (isset($_SESSION))
+  	if (isset($_SESSION[$key]))
+  	{
   		return $_SESSION[$key];

@@ Line 113: / Line 113: @@
+  	}
   	ob_start();
-  	/* adding double quotes for "csrfguard_inject" to prevent: Notice: Use of undefined constant csrfguard_inject - assumed 'csrfguard_inject' */
+  	/* adding double quotes for "csrfguard_inject" to prevent:
   	register_shutdown_function("csrfguard_inject");
+  }

← Older revision		Revision as of 00:08, 8 December 2012
Line 144:		Line 144:
	=Author and License=		=Author and License=
	This piece of code is by [mailto:abbas.naderi@owasp.org Abbas Naderi Afooshteh] from OWASP under Creative Commons 3.0 License.		This piece of code is by [mailto:abbas.naderi@owasp.org Abbas Naderi Afooshteh] from OWASP under Creative Commons 3.0 License.
		+
		+	Contributions from Krzysztof Kotowicz <krzysztof.kotowicz at securing.pl>, Jakub Kałużny <jakub.artur.kaluzny at g>

@@ Line 101: / Line 101: @@
   	if (count($_POST))
+  	{
-  		if (!isset($_POST['CSRFName']))
+  		if ( !isset($_POST['CSRFName']) or !isset($_POST['CSRFToken']) )
+  		{
   			trigger_error("No CSRFName found, probable invalid request.",E_USER_ERROR);

← Older revision		Revision as of 23:59, 7 December 2012
Line 1:		Line 1:
	=Code Snippet=		=Code Snippet=
		+	'''CAUTION:''' This code snippet below is segmented intentionally. You are not supposed to copy paste this code, unless you understand its risks and how it operates. It is not verified by OWASP professional, just composed by them. Up until now two small flaws have been reported and fixed in this code. Also it uses regular expressions which are not even close to a good solution for parsing HTML ([http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags see why]), it is just there to give you an insight on what should be done. See the discussion page for more details.

	If you need to protect against CSRF attacks in your code, this little helper can reduce the risk:		If you need to protect against CSRF attacks in your code, this little helper can reduce the risk: