kylekatarnls/csrfprotect

CSRF Protection

CsrfProtect

, _(*1)

PHP extencion to handle easily a really reliable CSRF protection, _(*2)

Basic usage: Form protection

Authentificated user

Protect a link

<a href="?_csrf=<?php echo Csrf::getToken(); ?>">Click here!</a>

Protect a link with an authentificated user

<a href="?_csrf=<?php echo Csrf::getToken($_SESSION['user_id']); ?>">Click here!</a>

Configure CsrfProtect as you need

Here are all the available settings and their default values:, _(*3)

Extends CsrfProtect

Example: display the input tage in a XHTML way: <input />, _(*4)

', ' />', parent::getTag($identifier));
    }
}

?>

The functionnal way

All the public CsrfProtect methods are also available as functions., _(*5)

Installation

You can install CsrfProtect anywhere Zephir can be installed., _(*6)

Here is an example with Debian/Ubuntu (we suppose you have PHP installed):, _(*7)

sudo apt-get update
sudo apt-get install git gcc make re2c php5 php5-json php5-dev libpcre3-dev
git clone https://github.com/phalcon/zephir
cd zephir
./install-json
./install -c
cd ..

(Optionnal) Then you can remove Zephir sources:, _(*8)

rm -r zephir

Then check zephir is well installed:, _(*9)

zephir help

If it's not, please see: http://docs.zephir-lang.com/en/latest/install.html, _(*10)

Now you can download and build CsrfProtect, _(*11)

git clone https://github.com/kylekatarnls/csrfprotect
zephir build

(Optionnal) Then you can remove CsrfProtect sources:, _(*12)

rm -r csrfprotect

Then add extension=csrfprotect.so to your PHP configuration., _(*13)

# Suse: Add a file called csrfprotect.ini in /etc/php5/conf.d/ with this content:
extension=csrfprotect.so

# CentOS/RedHat/Fedora: Add a file called csrfprotect.ini in /etc/php.d/ with this content:
extension=csrfprotect.so

# Ubuntu/Debian with apache2: Add a file called 30-csrfprotect.ini in /etc/php5/apache2/conf.d/ with this content:
extension=csrfprotect.so

# Ubuntu/Debian with php5-fpm: Add a file called 30-csrfprotect.ini in /etc/php5/fpm/conf.d/ with this content:
extension=csrfprotect.so

# Ubuntu/Debian with php5-cli: Add a file called 30-csrfprotect.ini in /etc/php5/cli/conf.d/ with this content:
extension=csrfprotect.so