CSRF attacks are used to fake requests using the user's logged in identity. Specifically, the attacker induces users to access malicious websites, sends requests in the user's name without the user's knowledge, and performs non-intentional operations. A common way to prevent CSRF is to use the CSRF token mechanism, 1. Generate a unique random token; 2. Save the token in the Session and form hidden fields; 3. Compare whether the two are consistent when submitting. Other protection methods include checking the Referer header, setting the SameSite Cookie attribute, and introducing a verification code mechanism. Easy to ignore points include AJAX request not token, token generation is unsafe, and token storage into cookies incorrectly. The correct way to do this is to just store the token in the Session and pass it through the hidden fields.

CSRF (Cross-Site Request Forgery) is a common web security vulnerability. By inducing users to access malicious websites, the attacker sends requests to the target website in the name of the user without the user's knowledge, and performs some non-intentional operations, such as password modification, transfer, etc.

The reason why this attack is successful is that the browser will automatically bring cookie information related to the target website when sending a request. As long as the user has logged in to the website before and has not logged out, the attacker can "impersonate" the user to operate.

What is a CSRF attack?

Simply put, CSRF uses the user's login identity to secretly initiate a request. For example:

• The user logged into a bank website bank.com
• The attacker induces the user to access a malicious page with a hidden form inside, and the submission address is bank.com/transfer
• After the form is automatically submitted, the server performs the transfer operation since the user is still logged in.

The entire process may be unaware of it, but the operation has been completed by the attacker.

How to prevent CSRF attacks in PHP?

The most common and most effective way to prevent CSRF in PHP is to use the CSRF Token mechanism. The specific steps are as follows:

• Generate a unique random token every time the form is generated
• Save the token in the hidden fields of the Session and form at the same time
• When submitting a form, whether the token in the Session and the token submitted are consistent.

If the two are inconsistent, it means that the source of the request is untrusted and the processing is directly refused.

For example:

 // Generate token and store it in Session
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(50));
}

// Embed the token when outputting the form
echo &#39;<input type="hidden" name="csrf_token" value="&#39; . $_SESSION[&#39;csrf_token&#39;] . &#39;">&#39;;

// Verify the Token when submitting the process
if ($_POST[&#39;csrf_token&#39;] !== $_SESSION[&#39;csrf_token&#39;]) {
    die(&#39;illegal request&#39;);
}

This method can effectively prevent cross-domain request forgery, because the attacker cannot obtain the token value in the user's current page.

What other protective measures are there?

In addition to tokens, protection can be strengthened in combination with the following methods:

• Check the Referer header : Make sure the request comes from your own website

  Note: Some browsers or privacy settings may block Referer and cannot rely on it alone

• SameSite Cookie Attribute : Set Cookie to SameSite=Strict or Lax

  This way the browser will not carry cookies in cross-site requests, reducing risks from the source

• Verification code mechanism : for highly sensitive operations (such as modifying passwords), add verification code to confirm

  Although the user experience is slightly poor, the security is higher

These methods can be used as a supplement to the token mechanism to form a multi-layer defense system.

What are the places that are easy to ignore?

Sometimes developers only use tokens in forms, but forget to add them in AJAX requests, which leaves a vulnerability.
In addition, the token should be random and unpredictable enough to be spliced with timestamps or simple strings.

Some people also store tokens in cookies, which is not safe, because cross-site requests can also read cookies.
The correct way is to only exist in the Session and pass it to the front end through hidden fields.

Basically that's it. Protecting CSRF is actually not complicated, but if the details are not done properly, it is easy to be broken.

The above is the detailed content of Describe the Concept of CSRF and How to Protect Against it in PHP. For more information, please follow other related articles on the PHP Chinese website!