Helpers\CSRF

Helpers\CSRF

CSRF Protection

The CSRF helper is used to protect post request from cross site request forgeries. For more information on CSRF see https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

To use place at the top of controller like:<

namespace Controllers;

use Core\Controller;
use Helpers\Csrf;
use Helpers\Session;

class Pet extends Controller
{
    private $model;

    public function __construct()
    {
        parent::__construct();
        $this->model = new \Models\PetModel();
    }

In your add or edit method create the token. If you use separate methods to open an edit view and a different method to update, create it in the edit method like:

function edit()
{
    $id = filter_input(INPUT_GET, 'id'); //suggested way....
    $data['csrfToken'] = Csrf::makeToken('edit');
    $data['row'] = $this->model->getPet($id);

    View::renderTemplate('header', $data);
    View::render('pet/edit', $data, $error);
    View::renderTemplate('footer', $data);
}

Before the submit button in same view, place this hidden field:

<input type="hidden" name="token" value="<?php echo $data['csrfToken']; ?>" />

In the controller and at the top of the method that processes the form, update here is only an example, place:

function update()
{
    if (isset($_POST['submit'])) { // or the name/value you assign to button.
       if (!Csrf::isTokenValid('edit')) {
            Url::redirect('admin/login'); // Or to a url you choose.......
        }

        $id = $_POST['id'];
        $petname = $_POST['petname'];
        // other processing code