Csrf
in package
Protection against Cross Site Request Forgery (CSRF) attacks
Table of Contents
Methods
- check() : mixed
- Gets the CSRF token in the postdata.
- checkOrDie() : mixed
- Checks the CSRF token If it fails, redirect the user to the home page, and report an error
- getTokenValue() : string
- Fetches the secret token value
- token() : string
- Generates a CSRF hidden form field
- initialiseSession() : void
- Initialises the PHP session and, if not present, generates a CSRF secret for the session
Methods
check()
Gets the CSRF token in the postdata.
public
static check() : mixed
Checks that it is valid. Returns TRUE on success and FALSE on failure
checkOrDie()
Checks the CSRF token If it fails, redirect the user to the home page, and report an error
public
static checkOrDie() : mixed
getTokenValue()
Fetches the secret token value
public
static getTokenValue() : string
This is intended for use on JavaScript requests that require CSRF protection. Note that it is important that this value isn't placed in GET parameters, as this may result in the value being leaked through logging or other methods.
Return values
string —The CSRF secret
token()
Generates a CSRF hidden form field
public
static token() : string
Return values
string —HTML: an tag which contains the token
initialiseSession()
Initialises the PHP session and, if not present, generates a CSRF secret for the session
protected
static initialiseSession() : void