AntiCSRF class

Framework\HTTP\AntiCSRF

Class AntiCSRF.

Defined in libraries/http/src/AntiCSRF.php

Properties #

$tokenName
-
$request
-
$verified
-
$enabled
-
$tokenBytesLength
-
$generateTokenFunction
-
$generateTokenFunctions
-

$tokenName

protected string $tokenName = 'csrf_token'

$request

protected \Framework\HTTP\Request $request

$verified

protected bool $verified = false

$enabled

protected bool $enabled = true

$tokenBytesLength

protected int $tokenBytesLength = 8

$generateTokenFunction

protected string $generateTokenFunction = 'base64_encode'

$generateTokenFunctions

protected array $generateTokenFunctions = array ( 0 => 'base64_encode', 1 => 'bin2hex', 2 => 'md5', )

Methods #

__construct()
AntiCSRF constructor.
disable()
Disables the Anti CSRF verification.
enable()
Enables the Anti CSRF verification.
generateToken()
-
getGenerateTokenFunction()
-
getToken()
Gets the anti-csrf token from the session.
getTokenBytesLength()
-
getTokenName()
Gets the anti-csrf token name.
getUserToken()
Gets the user token from the request input form.
input()
Gets the HTML form hidden input if the verification is enabled.
isEnabled()
Tells if the verification is enabled.
isSafeMethod()
Safe HTTP Request methods are: GET, HEAD and OPTIONS.
setGenerateTokenFunction()
-
setToken()
Sets the anti-csrf token into the session.
setTokenBytesLength()
-
setTokenName()
Sets the anti-csrf token name.
validate()
Validates if a user token is equals the session token.
verify()
Verifies the request input token, if the verification is enabled. The verification always succeed on HTTP GET, HEAD and OPTIONS methods. If verification is successful with other HTTP methods, a new token is generated.
isVerified()
-
setVerified()
-

__construct()

public function __construct(\Framework\HTTP\Request $request, ?int $tokenBytesLength = NULL, ?string $generateTokenFunction = NULL)

AntiCSRF constructor.

Parameters
  • \Framework\HTTP\Request $request
  • ?int $tokenBytesLength
  • ?string $generateTokenFunction

disable()

public function disable(): static

Disables the Anti CSRF verification.

Returns static

enable()

public function enable(): static

Enables the Anti CSRF verification.

Returns static

generateToken()

public function generateToken(): string
Returns string

getGenerateTokenFunction()

public function getGenerateTokenFunction(): string
Returns string

getToken()

public function getToken(): ?string

Gets the anti-csrf token from the session.

Returns ?string

getTokenBytesLength()

public function getTokenBytesLength(): int
Returns int

getTokenName()

public function getTokenName(): string

Gets the anti-csrf token name.

Returns string

getUserToken()

public function getUserToken(): ?string

Gets the user token from the request input form.

Returns ?string

input()

public function input(): string

Gets the HTML form hidden input if the verification is enabled.

Returns string

isEnabled()

public function isEnabled(): bool

Tells if the verification is enabled.

Returns bool

isSafeMethod()

public function isSafeMethod(): bool

Safe HTTP Request methods are: GET, HEAD and OPTIONS.

Returns bool

setGenerateTokenFunction()

public function setGenerateTokenFunction(string $function): static
Parameters
  • string $function
Returns static

setToken()

public function setToken(?string $token = NULL): static

Sets the anti-csrf token into the session.

Parameters
  • ?string $token - A custom anti-csrf token or null to generate one
Returns static

setTokenBytesLength()

public function setTokenBytesLength(int $length): static
Parameters
  • int $length
Returns static

setTokenName()

public function setTokenName(string $tokenName): static

Sets the anti-csrf token name.

Parameters
  • string $tokenName
Returns static

validate()

public function validate(string $userToken): bool

Validates if a user token is equals the session token.

This method can be used to validate tokens not received through forms.
For example: Through a request header, JSON, etc.

Parameters
  • string $userToken
Returns bool

verify()

public function verify(): bool

Verifies the request input token, if the verification is enabled. The verification always succeed on HTTP GET, HEAD and OPTIONS methods. If verification is successful with other HTTP methods, a new token is generated.

Returns bool

isVerified()

protected function isVerified(): bool
Returns bool

setVerified()

protected function setVerified(bool $status = true): static
Parameters
  • bool $status
Returns static