Download the PHP package enlivenapp/flight-csrf without Composer
On this page you can find all versions of the php package enlivenapp/flight-csrf. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download enlivenapp/flight-csrf
More information about enlivenapp/flight-csrf
Files in enlivenapp/flight-csrf
Package flight-csrf
Short Description CSRF protection middleware and helpers for FlightPHP
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package flight-csrf
flight-csrf
CSRF protection middleware and helpers for FlightPHP.
Requirements
- PHP 8.1+
Installation
Setup
After installing, register the plugin to load the helper functions and scaffold default config:
Call this early in your bootstrap, before defining routes. register() does two things: it requires the helper file that defines csrf_field() and csrf_token(), and it writes default config keys into app/config/config.php if they're missing.
If you'd rather set things up yourself, skip register() and do the following instead:
- Require
vendor/enlivenapp/flight-csrf/src/Helpers/csrf_helper.phpfrom your bootstrap. - Add the config block manually (see Configuration below).
Usage
Forms
Call csrf_field() to output a hidden input in any HTML form. The token is generated and stored in the session automatically.
AJAX requests
Call csrf_token() to get the raw token value. The common pattern is to embed it in a meta tag and read it from JavaScript.
The middleware accepts the token from either the _csrf_token POST field or the X-CSRF-TOKEN request header. The POST field is checked first.
Protecting routes
Apply CsrfMiddleware to any route or route group that needs protection:
When validation fails the middleware halts the request with a 403 response. The body is {"error":"CSRF token validation failed."} as JSON.
Configuration
Config lives under the enlivenapp.flight-csrf key. Defaults are in src/Config/Config.php. Override them in your app config, and values are merged on top of the defaults.
| Key | Default | Description |
|---|---|---|
field_name |
_csrf_token |
Name of the hidden form field |
session_key |
_csrf_token |
Session key used to store the token |
protected_methods |
['POST','PUT','PATCH','DELETE'] |
HTTP methods that trigger validation |
exclude_routes |
[] |
Request paths to skip (exact URI match, no query string) |
token_lifetime |
7200 |
Seconds from creation before the token expires. 0 disables time-based expiry. Expired tokens fail validation (403) and rotate on the next csrf_token() or csrf_field() call. |
Overriding defaults
When Plugin::register() runs for the first time, it writes token_lifetime and exclude_routes into your config file so you can edit them in place. You can add any other key to the same block.
License
MIT
