CsrfProtection
in package
CsrfProtection - CSRF Token Management
Replaces procedural functions from app/include/csrf.php Handles generation and validation of CSRF tokens in an OOP manner.
CSRF (Cross-Site Request Forgery) protection prevents unauthorized commands from being transmitted from a user the web application trusts.
Features:
- Cryptographically secure token generation
- Time-based token expiration (4 hours with sliding window)
- Timing-safe token comparison
- HTML field generation for forms
- Automatic token refresh on valid usage
Tags
Table of Contents
Constants
- TOKEN_KEY = 'csrf_token'
- TOKEN_LIFETIME = 14400
- TOKEN_TIME_KEY = 'csrf_token_time'
Properties
Methods
- __construct() : mixed
- generateToken() : string
- Generate a new CSRF token
- getToken() : string
- Get the current CSRF token (or generate a new one)
- getTokenField() : string
- Generate an HTML hidden input field with the CSRF token
- invalidateToken() : void
- Invalidate the current CSRF token
- refreshToken() : void
- Refresh the CSRF token timestamp
- requireValidToken() : void
- Validate a CSRF token and throw exception if invalid
- validateToken() : bool
- Validate a CSRF token
Constants
TOKEN_KEY
private
mixed
TOKEN_KEY
= 'csrf_token'
TOKEN_LIFETIME
private
mixed
TOKEN_LIFETIME
= 14400
TOKEN_TIME_KEY
private
mixed
TOKEN_TIME_KEY
= 'csrf_token_time'
Properties
$session
private
SessionManager
$session
Methods
__construct()
public
__construct(SessionManager $session) : mixed
Parameters
- $session : SessionManager
generateToken()
Generate a new CSRF token
public
generateToken() : string
Creates a cryptographically secure random token and stores it in the session with a timestamp.
Return values
string —The generated token (64 hex characters)
getToken()
Get the current CSRF token (or generate a new one)
public
getToken() : string
Returns the existing token from session, or generates a new one if none exists.
Return values
string —The current CSRF token
getTokenField()
Generate an HTML hidden input field with the CSRF token
public
getTokenField() : string
Convenience method for forms. Use this in all POST forms:
Return values
string —HTML input tag with CSRF token
invalidateToken()
Invalidate the current CSRF token
public
invalidateToken() : void
Removes the token from session, forcing generation of a new one. Useful after logout or when rotating tokens for extra security.
refreshToken()
Refresh the CSRF token timestamp
public
refreshToken() : void
Updates the token timestamp to the current time without regenerating the token itself. This implements a "sliding window" expiration strategy where active users don't experience token expiration.
requireValidToken()
Validate a CSRF token and throw exception if invalid
public
requireValidToken(string $token) : void
Convenience method for strict validation in controllers.
Parameters
- $token : string
-
The token to validate
Tags
validateToken()
Validate a CSRF token
public
validateToken(string $token) : bool
Checks if the provided token matches the session token and hasn't expired (4 hour lifetime with sliding window). Uses timing-safe comparison to prevent timing attacks. Automatically refreshes the token timestamp on successful validation.
Parameters
- $token : string
-
The token to validate
Return values
bool —True if valid, false otherwise