How to check the CSRF token?

I'm not a huge fan of Phalcon's built-in CSRF component for the same reasons - a token is only valid once per session. Multiple page loads invalidate the first token generated.

For that reason, I built my own that only generates the token and key once per session and re-uses it.

I also think that the current built-in CSRF component of Phalcon can only be used in limited situations.

Today, it can be said that CSRF measures should be implemented on all input forms. I think site-wide tokens are one good solution, but I would love tokens tied to individual pages (or controllers or actions). (I don't feel the need to post form data from multiple same action pages in the same browser, and I think that if you really need it, you should remove CSRF.)

Similarly, I would like you to improve the cooperation with validation which does not work well in Forms at present.

By the way, when I query the server with AJAX in a certain form, I have succeeded in checking the token value of the form without changing the token value.

$this->security->checkToken(null, null, false)

So I want you to keep like this.

I'm not a huge fan of Phalcon's built-in CSRF component for the same reasons - a token is only valid once per session. Multiple page loads invalidate the first token generated.

For that reason, I built my own that only generates the token and key once per session and re-uses it.

for me i created a class extends Phalcon\Security and replaced the security service with it

i remember getting the idea from here somewhere but couldn't find the thread anyway you can try this

TokenManager.php

class TokenManager extends \Phalcon\Security
{
    public function getToken()
    {
        $token = $this->getSessionToken();

        if (!$token) {
            return parent::getToken();
        }

        return $token;
    }

    public function getTokenKey()
    {
        $container = $this->getDI();

        $session = $container->getShared("session");

        $tokenKey = $session->get($this->_tokenKeySessionID);

        if (!$tokenKey) {
            return parent::getTokenKey();
        }

        return $tokenKey;
    }
}

services.php

$di->setShared('security', function () {
    return new TokenManager;
});

if i'm using html forms:

<input type="hidden" name="<?= $this->security->getTokenKey() ?>" value="<?= $this->security->getToken() ?>"/>

then in controller

// html form
$this->security->checkToken(null, null, false);

// javascript ( fetch, axios, etc... )
$this->security->checkToken($this->request->getPost('tokenKey'), $this->request->getPost('token'), false);

hi Thanks for the reply. Since MVC increases the number of files even if it is free, I do not want to increase the number of files if possible, so I would like to avoid the suggested method or the method of creating a base class of form. I will. (If it is unavoidable, I will use it.)

I'm sorry to the people who make it, but I still can not wipe the impression that the implementation of Forms and Security class is incomplete.

for me i created a class extends Phalcon\Security and replaced the security service with it

i remember getting the idea from here somewhere but couldn't find the thread anyway you can try this

TokenManager.php

class TokenManager extends \Phalcon\Security
{
   public function getToken()
   {
       $token = $this->getSessionToken();

       if (!$token) {
           return parent::getToken();
       }

       return $token;
   }

   public function getTokenKey()
   {
       $container = $this->getDI();

       $session = $container->getShared("session");

       $tokenKey = $session->get($this->_tokenKeySessionID);

       if (!$tokenKey) {
           return parent::getTokenKey();
       }

       return $tokenKey;
   }
}

services.php

$di->setShared('security', function () {
   return new TokenManager;
});

if i'm using html forms:

<input type="hidden" name="<?= $this->security->getTokenKey() ?>" value="<?= $this->security->getToken() ?>"/>

then in controller

// html form
$this->security->checkToken(null, null, false);

// javascript ( fetch, axios, etc... )
$this->security->checkToken($this->request->getPost('tokenKey'), $this->request->getPost('token'), false);

Reducing the number of files is what I would call a "micro-optimization". Sure, it might cause your site to load a few nanoseconds slower, but the actual effect won't be noticable.

well Phalcon's CSFR implementation is that you can assign a new form within the controller and pass it to the view , so when the form is submitted the action on the controller that was assigned by the post url you will need to verify that token and only once per page rerquest since it changes every load.

'Controller'

<?php

namespace Website\Controllers;

use Phalcon\Forms\Form,
    Phalcon\Forms\Element\Hidden;

class IndexController extends ControllerBase
{
  public function IndexAction()
  {
    $form = new Form;

    $element['security'] = new Hidden( "security" ,[
      'name'  => $this->security->getTokenKey(),
      'value' => $this->security->getToken()
    ]);
    foreach ($element as $e)
    {
      $form->add($e);
    }
    $this->view->form    = $form;
  }
}

and then the action to check it :

$this->security->checkToken()  # returns Boolean

I understand your opinion very well. Increasing a few read files will not add much delay. But I think that's because of the difference in thinking. It's the same as thinking that a cup with half water is "half full" or "half empty".

And I think the overall speedup is the accumulation of "micro-optimization". Other frameworks need to read themselves, but Phalcon is not needed, right? I feel that the advantage is getting smaller and smaller as the number of adjustment files increases. Maybe I care too much.

There is another point to worry about. You have shown that the time required to read a file is nanoseconds, but the storage devices in the world have not yet been accelerated (not all disks have been replaced by hard disks with SSDs), so reading physical files I think it will take a little more time (at least about microseconds). Of course, depending on the adjustment of op-cache, I think it will be short enough to be ignored as you show.

Reducing the number of files is what I would call a "micro-optimization". Sure, it might cause your site to load a few nanoseconds slower, but the actual effect won't be noticable.

Thanks for the reply.

I agree. I understand that CSRF check should not be included in isValid() and should be done independently in the controller. It seems that it is not possible to check it in batch with isValid() by adding validation when defining the element.

well Phalcon's CSFR implementation is that you can assign a new form within the controller and pass it to the view , so when the form is submitted the action on the controller that was assigned by the post url you will need to verify that token and only once per page rerquest since it changes every load.

'Controller'

<?php

namespace Website\Controllers;

use Phalcon\Forms\Form,
   Phalcon\Forms\Element\Hidden;

class IndexController extends ControllerBase
{
 public function IndexAction()
 {
   $form = new Form;

   $element['security'] = new Hidden( "security" ,[
     'name'  => $this->security->getTokenKey(),
     'value' => $this->security->getToken()
   ]);
   foreach ($element as $e)
   {
     $form->add($e);
   }
   $this->view->form    = $form;
 }
}

and then the action to check it :

$this->security->checkToken()  # returns Boolean