All 7 Security questions
More in Security
What is SQL injection, and how does using prepared statements with PDO help prevent this common vulnerability in PHP applications? What is cross site scripting, commonly called XSS, and how does properly escaping output help prevent it? Why should passwords always be hashed before storing them in a database, and how does PHP's password_hash function make this straightforward and secure? Why is validating and sanitizing file uploads important, and what specific checks should you perform to prevent an attacker from uploading a malicious file? What is the principle of least privilege, and how should it guide decisions about database user permissions and environment configuration in a PHP application? How can PHP's built in disabled functions setting and other server level configuration hardening reduce the impact of a successful attack against an application?
Advertisement
Back to results for “Security”
PHP › Security

What is cross site request forgery, commonly called CSRF, and how do CSRF tokens help protect forms from this type of attack?

Intermediate

Answer

Cross site request forgery tricks a logged in user's browser into unknowingly submitting a request to an application they are authenticated with, such as changing their account settings or making a purchase, often by embedding a hidden form or link on a malicious page, and a CSRF token defends against this by including a unique, unpredictable value in every legitimate form that the server generated and remembers, then rejecting any submitted request that does not include that exact matching token, since an attacker's malicious page would have no way of knowing what that token's value actually is.
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">

// On submission
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('Invalid request');
}
Real-world example A banking application includes a unique CSRF token in its funds transfer form, ensuring that even if an attacker tricks a logged in user into visiting a malicious page that attempts to auto submit a transfer request, the request is rejected because it lacks the correct token value.

Common follow-ups: How often should a CSRF token be regenerated?;Do frameworks like Laravel handle CSRF protection automatically for you?

Form Handling & Validation;Sessions & Cookies
All 7 Security questions