Home > Article > Backend Development > How PHP defends against CSRF attacks
How to use PHP to defend against cross-site request forgery (CSRF) attacks
With the development and popularity of web applications, network security issues are becoming more and more important. Cross-site request forgery (CSRF) attacks have become one of the common attack methods. A CSRF attack refers to an attacker performing some malicious operations by impersonating requests from legitimate users, such as transferring money, changing passwords, etc. without the user being aware of it. To protect users and web applications, developers need to take steps to defend against such attacks. This article will introduce how to use PHP to defend against CSRF attacks.
Here is a sample code that uses a token:
// 生成令牌 function generateToken() { $token = bin2hex(random_bytes(32)); $_SESSION['csrf_token'] = $token; return $token; } // 验证令牌 function verifyToken($token) { if(isset($_SESSION['csrf_token']) && $_SESSION['csrf_token'] === $token) { return true; } return false; } // 在表单中添加令牌字段 function addTokenField() { $token = generateToken(); echo '<input type="hidden" name="csrf_token" value="'.$token.'">'; }
Sample code to verify the Referer header:
function verifyReferer() { if(isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) !== false) { return true; } return false; }
Sample code to verify the Origin header:
function verifyOrigin() { if(isset($_SERVER['HTTP_ORIGIN']) && $_SERVER['HTTP_ORIGIN'] === 'https://www.example.com') { return true; } return false; }
Sample code for setting Cookie attributes:
session_set_cookie_params([ 'lifetime' => 86400, // Cookie的有效期为一天 'path' => '/', 'domain' => '.example.com', 'secure' => true, // 仅在HTTPS连接下传输 'httponly' => true // 仅通过HTTP协议访问 ]); session_start();
During the login process, we can generate a login token and store it on the server side and in the Session. In each login request, we need to verify the validity of the token to ensure that the token can only be obtained through the login process.
During the logout process, we need to destroy the Session data related to the user and delete the Session ID. This prevents attackers from stealing Session IDs to impersonate users.
Summary:
CSRF attacks are a common network security problem, but we can take some measures to defend against this attack. This article introduces some methods of using PHP to defend against CSRF attacks, including generating and validating tokens, verifying request sources, setting cookie attributes, and paying attention to login and logout security. Through the combined use of these methods, we can effectively protect the security of web applications and users.
The above is the detailed content of How PHP defends against CSRF attacks. For more information, please follow other related articles on the PHP Chinese website!