How to handle cross-site request forgery (CSRF) attacks in PHP?

How to handle cross-site request forgery (CSRF) attacks in PHP?

Overview:
As network attacks continue to evolve, protecting website security has become one of the important tasks for developers. Cross-Site Request Forgery (CSRF) attacks are a common security threat. Attackers trick users into performing unexpected operations, allowing users to send malicious requests without their knowledge. To prevent such attacks, developers can take a number of steps to protect their sites. This article will explain how to handle CSRF attacks in PHP.

1. Understand the principles of CSRF attacks:
   Before we start to deal with CSRF attacks, we need to understand the principles of the attacks. A CSRF attack is performed by leveraging a user's logged-in credentials on other websites to perform unauthorized actions. The attacker will forge a request and send it to the target website, which will be executed using the user's identity. After receiving the request, the website will mistakenly believe that the request was sent by the user himself. Therefore, understanding this principle is crucial to effectively defend against CSRF attacks.
2. Use Token verification:
   Token verification is a common way to defend against CSRF attacks. It is based on generating a unique identifier (Token) for each user and embedding this Token into the form. When the user submits the form, the server will verify whether the Token in the form is consistent with the Token in the user's Session. If it is inconsistent, it means that this is a malicious request and the server will refuse to execute it.

The following is a sample code using Token verification:

// 生成Token
$token = bin2hex(random_bytes(32));
$_SESSION['csrf_token'] = $token;

// 将Token嵌入到表单中
<form method="post" action="process.php">
    <input type="hidden" name="csrf_token" value="<?php echo $token; ?>">
    <!-- other form fields -->
    <input type="submit" value="Submit">
</form>

// 在处理请求时验证Token
session_start();
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("Invalid CSRF token");
}
// 处理请求

3. Restrict HTTP Referer:
   HTTP Referer is an HTTP request header, which contains the request initiation page URL. We can use this header field to verify whether the request comes from the same domain name. When validating a request, we can check whether the requested Referer is the same as the current domain name. If it's different, it's probably a malicious request. However, it should be noted that Referer may be disabled or faked by some browsers or proxy servers, so this method does not guarantee complete security.

The following is a sample code to limit HTTP Referer:

$referer = $_SERVER['HTTP_REFERER'];
$allowed_referer = 'https://www.example.com';

if (strpos($referer, $allowed_referer) !== 0) {
    die("Invalid Referer");
}
// 处理请求

4. Set the SameSite Cookie attribute:
   In PHP 7.3 and above, you can set the SameSite cookie Attributes. The SameSite attribute can define that cookies can only be used on the same site, thus effectively preventing CSRF attacks. You can set the cookie's SameSite attribute to "Strict" or "Lax". "Strict" means that cookies are only allowed to be used by the same site, while "Lax" means that cookies are allowed in some cross-site situations, but not in POST requests.

The following is a sample code for setting the SameSite Cookie attribute:

session_start();
session_set_cookie_params([
    'httponly' => true,
    'samesite' => 'Lax'
]);

Conclusion:
Handling CSRF attacks in PHP requires a series of security measures. Using Token verification, limiting HTTP Referer, and setting SameSite Cookie attributes are all effective ways to defend against CSRF attacks. Although these methods can improve the security of the website, developers should always pay close attention to new security threats and best practices and update protection measures in a timely manner to ensure the security of the website.

The above is the detailed content of How to handle cross-site request forgery (CSRF) attacks in PHP?. For more information, please follow other related articles on the PHP Chinese website!