preventing csrf in php | 易学教程

问题

Requiring authentication in GET and POST parameters, not only cookies;
Checking the HTTP Referer header;

saw this post on wikipedia and was wondering how I can apply them

ok...I am using the Kohana PHP framework and I have the facility to determine the referrer header, but what exactly do I check in the referrer header? the framework function only returns the URL of the referrer

and how do I validate GET and POST params? against what? stored information? expected type?

回答1:

To prevent CSRF you'll want to validate a one-time token, POST'ed and associated with the current session. Something like the following . . .

On the page where the user requests to delete a record:

confirm.php

<?php
 session_start();
 $token = isset($_SESSION['delete_customer_token']) ? $_SESSION['delete_customer_token'] : "";
 if (!$token) {
     // generate token and persist for later verification
     // - in practice use openssl_random_pseudo_bytes() or similar instead of uniqid() 
     $token = md5(uniqid());
     $_SESSION['delete_customer_token']= $token;
 }
 session_write_close();
?>
<html>
<body>
<form method="post" action="confirm_save.php">
 <input type="hidden" name="token" value="<?php echo $token; ?>" />
Do you really want to delete?
<input type="submit" value=" Yes " />
<input type="button" value=" No " onclick="history.go(-1);" />
</form>
</body>
</html>

Then when it comes to actually deleting the record:

confirm_save.php

<?php
 session_start();
 // validate token
 $token = isset($_SESSION['delete_customer_token']) ? $_SESSION['delete_customer_token'] : "";
 if ($token && $_POST['token'] === $token) {
   // delete the record
   ...
   // remove token after successful delete
   unset($_SESSION['delete_customer_token']);
 } else {
   // log potential CSRF attack.
 }
 session_write_close();
?>

The token should be hard to guess, unique for each delete request, accepted via $_POST only and expire after a few minutes (expiration not shown in this example).

回答2:

With referral checking all your doing is looking to make sure the referer is from your site/system. If the referer does not exist or is from a foreign site then the referal check fails and you may not want to honor whatever request is being made.

In the past problems with various technologies and browsers (flash..et al) allowed forgery of referal headers. Its something to consider. There are several methods using javascript to link to resources where the referal data is not present/passed in the request header.

This behavior varies somewhat between browsers. If you use javascript to submit a form your typically ok. If you use something like window.location most likely you should not expect referal data to be present.

A popular method for CSRF prevention is to not use cookies and always pass state between references... Passing a session token in all links throughout an application.

回答3:

[Note:] Kohana framework is Deprecated, new fork for Kohana PHP 7 is https://koseven.ga/ and it does support CSRF functionality is Security class.

You can use Official koseven security feature. Here is a link to koseven security class.

来源：https://stackoverflow.com/questions/1780687/preventing-csrf-in-php

标签

php

security

kohana