Download the PHP package psecio/csrf without Composer
On this page you can find all versions of the php package psecio/csrf. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package csrf
Short Description CSRF Token Generation Library
License MIT
Homepage https://github.com/psecio/csrf.git
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package csrf
CSRF Handling
Cross-site request forgery (CSRF) tokens provide protection for your request submissions to help ensure they came from your application. The most common implementation in PHP uses the current session to store the token value and makes a comparison once the form is submitted. This library makes it simpler by handling this common task for you buy default. It:
- Provides effective random token generation via either OpenSSL or the PHP 7 csprng
- Handles the session storage and evaluation once the data is submitted.
Here's an example of it in use:
As you can see there's three main parts:
- The
Managerinstance - The call to the
generatemethod for creating and storing the token - The call to the
verifymethod to check the submitted token against what's been stored
The way the library stores tokens, a unique hash is created and the token is then stored with this as the key. This prevents the usual problem of only being able to store one token at a time and resulting in false errors if more than one tab is open for the same application.
Double-Submit Tokens
There's also a concept in web application security called double-submit cookies where the CSRF value is sent as a cookies as well as a part of the POST data. This cookie is set to HTTP Only meaning that no Javascript can access the cookie value, preventing theft from something like a cross-site scripting (XSS) attack.
To enable the automatic double-submit feature in this Csrf library, just pass true to the Manager constructor:
That's it - the storage and evaluation of the cookie is include in the verification process along with the value stored in the session.
Extending with your own storage method
The Manager class also includes an optional parameter that lets you define your own storage method if for some reason the default session method doesn't work for your application. You just define a class that extends the \Psecio\Csrf\Storage class and pass it in as a second parameter:
The Csrf library will then use this storage method instead of the session method. Note: If you change the first parameter to true it will still use the cookie method for double-submit handling.
