PHP CSRF

Summary: in this tutorial, you will learn about cross-site request forgery (CSRF) attacks and how to prevent them in PHP.

What is CSRF

CSRF stands for cross-site request forgery. It’s a kind of attack in which a hacker forces you to execute an action against a website where you’re currently logged in.

For example, you visit the malicious-site.com that has a hidden form. And that form submits on page load to yourbank.com/transfer-fund form.

Because you’re currently logged in to the yourbank.com, the request silently transfers a fund out of your bank account.

If yourbank.com/transfer-fund implements the CSRF correctly, it generates a one-time token and inserts the token into the fund transfer form like this:

<input type="hidden" 
       name="token"
       value="b3f44c1eb885409c222fdb78c125f5e7050ce4f3d15e8b15ffe51678dd3a33d3a18dd3">Code language: PHP (php)

When the malicious-site.com submits the form, the yourbank.com/transfer-fund form compares the token with the one on the yourbank.com‘s server.

If the token doesn’t exist in the submitted data or it doesn’t match with the token on the server, the fund transfer form will reject the submission and return an error.

When the malicious-site.com tries to submit the form, the token is likely not available or won’t match.

How to implement CSRF token in PHP

First, create a one-time token and add it to the $_SESSION variable:

$_SESSION['token'] = md5(uniqid(mt_rand(), true));Code language: PHP (php)

Second, add a hidden field whose value is the token and insert it into the form:

<input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?? '' ?>">Code language: PHP (php)

Third, when the form is submitted, check if the token exists in the INPUT_POST and compare it with the $_SESSION['token']:

<?php

$token = filter_input(INPUT_POST, 'token', FILTER_SANITIZE_STRING);

if (!$token || $token !== $_SESSION['token']) {
    // return 405 http status code
    header($_SERVER['SERVER_PROTOCOL'] . ' 405 Method Not Allowed');
    exit;
} else {
    // process the form
}Code language: PHP (php)

If the token doesn’t exist or doesn’t match, return the 405 HTTP status code and exit.

PHP CSRF example

We’ll create a simple fund transfer form to demonstrate how to prevent a CSRF attack: