PHP 中的 CSRF 保护

// in your session initialization (e.g., at login)
session_start();
if (empty($_session['csrf_token'])) {
    $_session['csrf_token'] = bin2hex(random_bytes(32));
}

// in your form
function generateformwithcsrftoken() {
    return '<form method="post" action="/submit">
        <input type="hidden" name="csrf_token" value="' . $_session['csrf_token'] . '">
        <!-- rest of your form fields -->
        <input type="submit" value="submit">
    </form>';
}

// in your form processing
function validatecsrftoken() {
    if (!isset($_post['csrf_token']) || !isset($_session['csrf_token']) ||
        !hash_equals($_session['csrf_token'], $_post['csrf_token'])) {
        die('csrf token validation failed');
    }
    return true;
}

// php backend
session_start();
if (empty($_session['csrf_token'])) {
    $_session['csrf_token'] = bin2hex(random_bytes(32));
}

// validate the token
if ($_server['request_method'] === 'post') {
    $headers = getallheaders();
    if (!isset($headers['x-csrf-token']) || 
        !hash_equals($_session['csrf_token'], $headers['x-csrf-token'])) {
        http_response_code(403);
        die('csrf token validation failed');
    }
}

// javascript frontend
const csrftoken = '<?php echo $_session["csrf_token"]; ?>';

fetch('/api/endpoint', {
    method: 'post',
    headers: {
        'x-csrf-token': csrftoken,
        'content-type': 'application/json'
    },
    body: json.stringify(data)
});

// set both cookie and session token
session_start();
$token = bin2hex(random_bytes(32));
$_session['csrf_token'] = $token;
setcookie('csrf_token', $token, [
    'httponly' => true,
    'secure' => true,
    'samesite' => 'strict'
]);

// validation function
function validatedoublesubmittoken() {
    if (!isset($_cookie['csrf_token']) || 
        !isset($_post['csrf_token']) || 
        !isset($_session['csrf_token'])) {
        return false;
    }

    return hash_equals($_cookie['csrf_token'], $_post['csrf_token']) && 
           hash_equals($_session['csrf_token'], $_post['csrf_token']);
}

// set cookie with samesite attribute
session_start();
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => $_server['http_host'],
    'secure' => true,
    'httponly' => true,
    'samesite' => 'strict'
]);

function generatesecuretoken($length = 32) {
    return bin2hex(random_bytes($length));
}

function validatetoken($usertoken, $storedtoken) {
    if (empty($usertoken) || empty($storedtoken)) {
        return false;
    }
    return hash_equals($storedtoken, $usertoken);
}

class csrfprotection {
    public static function gettokenfield() {
        return sprintf(
            '<input type="hidden" name="csrf_token" value="%s">',
            htmlspecialchars($_session['csrf_token'])
        );
    }
}

// in your form
@csrf

// manual token generation
{{ csrf_field() }}

// In your form
{{ csrf_token('form_name') }}