crodas/csrf-token

Easier way to generate CSRF tokens

CSRF (Cross-Site Request Forgery) stateless tokens.

Stateless CSRF-token generation and verification., _(*1)

Instalation

composer require crodas/csrf-token:"^1.0"

Properties

1. Hashes are unique per IP
2. They require a site secret, so hashes are impossible to forge.
3. Hashes expires after a certain amount of time (Default: 1 hour)

How to use it

Initialize the library:, _(*2)

require __DIR__ . '/vendor/autoload.php';

CSRF::setSecret($strong_secret_key);

Add it to your forms, _(*3)

<input type="hidden" name="_csrf" value="<?php echo CSRF::generate() ?>" />

And then verify the hashes are legit and still valid:, _(*4)

if (empty($_POST['_csrf']) || !CSRF::verify($_POST['_csrf'])) {
  throw new Exception("CSRF Token is invalid");
}