How PHP defends against CSRF attacks

How to use PHP to defend against cross-site request forgery (CSRF) attacks

With the development and popularity of web applications, network security issues are becoming more and more important. Cross-site request forgery (CSRF) attacks have become one of the common attack methods. A CSRF attack refers to an attacker performing some malicious operations by impersonating requests from legitimate users, such as transferring money, changing passwords, etc. without the user being aware of it. To protect users and web applications, developers need to take steps to defend against such attacks. This article will introduce how to use PHP to defend against CSRF attacks.

1. Understand the principles of CSRF attacks
   Before defending against CSRF attacks, we need to understand the principles of attacks. The principle of the CSRF attack is to use the cookie information after the user has logged in to other websites or web applications to disguise malicious requests as legitimate requests and send them to the target website or application. Therefore, CSRF attacks require that users of the target website must be legitimate users who have passed authentication.
2. Generate and verify token
   In order to defend against CSRF attacks, we can use tokens to verify the legitimacy of the request. The token is a randomly generated string that is associated with the user's session and is stored on the server side. In each form, we add a hidden field that contains the value of the token. When the user submits the form, we need to verify that the value of the token is consistent with the value stored on the server side. If they are inconsistent, the request is illegal and we can terminate the request or do other necessary processing.

Here is a sample code that uses a token:

// 生成令牌
function generateToken() {
    $token = bin2hex(random_bytes(32));
    $_SESSION['csrf_token'] = $token;
    return $token;
}

// 验证令牌
function verifyToken($token) {
    if(isset($_SESSION['csrf_token']) && $_SESSION['csrf_token'] === $token) {
        return true;
    }
    return false;
}

// 在表单中添加令牌字段
function addTokenField() {
    $token = generateToken();
    echo '<input type="hidden" name="csrf_token" value="'.$token.'">';
}

3. Verify the request source
   It is not enough to verify the token as the attacker can still pass other method to obtain the token. For added security, we can also verify the origin of the request. There are two methods to verify the source of the request: one is to verify the Referer header, and the other is to verify the Origin header.

Sample code to verify the Referer header:

function verifyReferer() {
    if(isset($_SERVER['HTTP_REFERER']) && strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) !== false) {
        return true;
    }
    return false;
}

Sample code to verify the Origin header:

function verifyOrigin() {
    if(isset($_SERVER['HTTP_ORIGIN']) && $_SERVER['HTTP_ORIGIN'] === 'https://www.example.com') {
        return true;
    }
    return false;
}

4. Set Cookie attributes appropriately
   In order to To improve security, we can increase the difficulty of CSRF attacks by setting the attributes of Cookies. For example, you can set cookies to be transmitted only under HTTPS connections, limit the scope of cookies to only the current domain name, etc.

Sample code for setting Cookie attributes:

session_set_cookie_params([
    'lifetime' => 86400, // Cookie的有效期为一天
    'path' => '/',
    'domain' => '.example.com',
    'secure' => true, // 仅在HTTPS连接下传输
    'httponly' => true // 仅通过HTTP协议访问
]);
session_start();

5. Pay attention to the security of login and logout
   Login and logout are very important operations in web applications. They The security also requires special attention. Properly handling the login and logout process can effectively defend against CSRF attacks.

During the login process, we can generate a login token and store it on the server side and in the Session. In each login request, we need to verify the validity of the token to ensure that the token can only be obtained through the login process.

During the logout process, we need to destroy the Session data related to the user and delete the Session ID. This prevents attackers from stealing Session IDs to impersonate users.

Summary:
CSRF attacks are a common network security problem, but we can take some measures to defend against this attack. This article introduces some methods of using PHP to defend against CSRF attacks, including generating and validating tokens, verifying request sources, setting cookie attributes, and paying attention to login and logout security. Through the combined use of these methods, we can effectively protect the security of web applications and users.

The above is the detailed content of How PHP defends against CSRF attacks. For more information, please follow other related articles on the PHP Chinese website!