Download the PHP package tigerwill90/xsrf-middleware without Composer

PSR-7 & PSR-15 : CSRF Protection alternative for JWT/Branca Authentication token

Csrf protection based on double submit pattern, cookie - JWT/Branca alternative.

It is based on PSR-7 JWT Authentication Middleware from Tuupola. This middleware is designed to work with JWT/Branca Authentication method and can be used with any framework using PSR-7 or PSR-15 style middlewares (since v1.1.0). It has been tested with Slim Framework.

This middleware does not provide ways to generate Branca/JWT token. However you can find all you needs for generate token with links bellow.

• Firebase/php-jwt
• Tuupola/branca-php
• Tuupola/base62

The goal is to protect rest api again Cross-site request forgery attak, using double submit pattern (stateless).

How it's work ?

Sometimes you want save your Jwt/Branca token in a http only cookie. Since it's not possible to grab it, your payload content is safe. It's particularly true for JWT who have no-encrypted payload. BUT, this protection expose your api to CSRF attack.

When a user authenticate to a site

• generate an anti-csrf token with pseudorandom value
• generate JWT or Branca and set one of payload attribute with the previously token generated
• send JWT or Branca to frontend in a http-only, secure cookie.
• send the previously token generated in the response body

When an authenticated api consumer want access to your api, you need to attach the anti-csrf token as

• eventually a cookie with unique name
• a header proprieties
• a request body parameter

For all unsafe operation [POST | PUT | PATCH | DELETE] to you api, the middleware inspect both token and JWT or Branca in http-only cookie to check if value match and return 401 status if not.

Dependencies

• dflydev-fig-cookies
• tuupola/callable-handler
• tuupola/http-factory
• rybakit/msgpack
• php-fig standards

Install

`

Usage

Configuration options are passed as an array. There is no mandatory parameter.

When a request is made, the middleware inspect both token and cookie to check if value match. If cookie or token is not found, the server will respond with 401 Unauthorized

Optional parameters

Path

The optional path parameter allows you to specify which ressources of your api is protected by the double submit pattern. It can be either a string or an array. You do not need to specify each URL.

Default parameter is /

In this example, everything starting with /api will be protected.

Passthrough

The optional passthrough parameter allows you to specify an exceptions to path parameter. It can be either a string or an array.

Default parameter is null

In this example, everything starting with /api and /admin will be protected, except /api/orders

AntiCsrf

The optional anticsrf parameter allow you to specify the name of your anti-csrf cookie, header or parameter.

Default parameter is xCsrf

In this example, if the cookie, header or request parameter "xCsrf" exist, the middleware will compare his value with the specified JWT/Branca token claim value.

Token

According to PSR-7 JWT Authentication Middleware documentation, when the token is decoded successfully and authentication succees, the contents of decoded token is saved as attribute to the $request. The optional token parameter allows you to specify the attribute name of JWT/Branca token that the middleware needs to find in $request.

Default parameter is token

Payload

Alternatively you can pass the contents of decoded token in the optional payload parameter.

Default value is null ` [2017-12-06 01:14:05] [WARNING]: Payload not found in parameter [2017-12-06 01:14:05] [DEBUG]: Token and cookie don't match, access denied !

phpunit

### License

The MIT License (MIT). Please see [License File](LICENSE.md) for more information.