aurmil/slim3-csrf-utilities

Slim Framework 3 CSRF protection middleware utilities

Slim 3 CSRF middleware utilities

Requires Slim 3 CSRF component, _(*1)

Basically, this package passes CSRF token to view (currently, official Slim Twig and PHP renderers are supported) or in response headers (for AJAX calls)., _(*2)

Installation

Requires Composer, _(*3)

composer require aurmil/slim3-csrf-utilities

Then require Composer autoload file, _(*4)

require 'vendor/autoload.php';

Usage

For an action that needs to display CSRF token in a view, add Aurmil\Slim\CsrfTokenToView middleware before Slim\Csrf\Guard., _(*5)

For an AJAX called action that needs to return new token to the caller in response headers, add Aurmil\Slim\CsrfTokenToHeaders middleware before Slim\Csrf\Guard., _(*6)

Let's consider a really light Slim app:, _(*7)

index.php, _(*8)

getContainer();

// If a route needs a view renderer
$container['renderer'] = function ($c) {
    return new \Slim\Views\Twig(__DIR__, ['cache' => false]); // Twig
    return new \Slim\Views\PhpRenderer(__DIR__.'/'); // Or PHP
};

// CSRF component
$container['csrf'] = function ($c) {
    return new \Slim\Csrf\Guard;
};

// HTML form including fields for CSRF token
$app->get('/', function ($request, $response) {
    return $this->renderer->render($response, 'view.twig'); // Twig
    return $this->renderer->render($response, 'view.php'); // Or PHP
})->add(new CsrfTokenToView($container->csrf, $container->renderer))
    ->add($container->csrf);

// CSRF protected action, can be called by AJAX
$app->post('/submit', function ($request, $response) {
    if ($request->isXhr()) {
        return $response->withJson(['success' => true]);
    } else {
        return $response->withRedirect('/');
    }
})->add(new CsrfTokenToHeaders($container->csrf))
    ->add($container->csrf);

// Slim dispatching
$app->run();
```

Twig view

```twig


    
        
        
    
    
        

$(function () {
    var form = $('form');
    form.on('submit', function () {
        $.ajax({
            url: form.attr('action'),
            method: form.attr('method'),
            data: form.serialize(),
            cache: false,
            dataType: 'json',
            success: function (data) {
                console.log('OK');
            },
            error: function () {
                console.log('error')
            },
            complete: function (jqXHR) {
                var csrfToken = jqXHR.getResponseHeader('X-CSRF-Token');

                if (csrfToken) {
                    try {
                        csrfToken = $.parseJSON(csrfToken);
                        var csrfTokenKeys = Object.keys(csrfToken);
                        var hiddenFields = form.find('input.csrf[type="hidden"]');

                        if (csrfTokenKeys.length === hiddenFields.length) {
                            hiddenFields.each(function(i) {
                                $(this).attr('name', csrfTokenKeys[i]);
                                $(this).val(csrfToken[csrfTokenKeys[i]]);
                            });
                        }
                    } catch (e) {

                    }
                }
            }
        });

        return false;
    });
});

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [QSA,L]
</IfModule>