Comments (5)
The Session class is a Cache-Based Session handler, which requires to have an activated Cache instance.
$f3->set('CACHE', true);
$s = new Session();
echo $s->csrf(); // z3sysduecint.p63g18fr7nvp
Though the Session handlers have some build in protection already, they only help you for Session-Hijacking attacks. You are right, for better security, this token should be used in forms or URIs that we want to protect.
if ($f3->exists('SESSION.csrf',$csrf))
var_dump($csrf); // old token from last request, to validate forms
$s = new Session();
$newToken = $s->csrf(); // token for current request, use this in hidden form fields
var_dump($newToken);
$f3->set('SESSION.csrf',$newToken);
I currently have no such check in fabulog, but will consider to add this as feature. thanks ;)
edit: I've added this to the docs. http://fatfreeframework.com/session#csrf
from fabulog.
Thanks for your reply.
I know where I got error.
if I test code like this:
$f3=require('lib/base.php');
$f3->set('CACHE',true);
if (true) {
/*do_login*/
$session = new Session();
$f3->set('SESSION.user_id',3); //
$f3->set('SESSION.csrf',$session->csrf());
var_dump($f3->get('SESSION'));
}
every thing is right.
But this gets the error:
$f3=require('lib/base.php');
$f3->set('CACHE',true);
if (true) {
/*do_login*/
$f3->clear('SESSION'); //this line added
$session = new Session();
$f3->set('SESSION.user_id',3);
$f3->set('SESSION.csrf',$session->csrf());
var_dump($f3->get('SESSION'));
//csrf token is false
}
from fabulog.
When a user login, should clear session first? Then can't get csrf token?
from fabulog.
It seems that the token is created when the session instance is create. The Session class check if other session data has exists, if not, the token won't be saved.
I add a method to the Session class to generate the token, and save it. Call the method when needed.
from fabulog.
i keep getting this error
"session_start(): Failed to read session data: user"
the csrf code gets generated but then the website won't work because that error 500, it's driving me crazy :S
from fabulog.
Related Issues (20)
- Admin user can be deleted HOT 1
- Feature request - Multilanguage module (f3-multilang) HOT 2
- Rewrite rule is redirecting www.mysite.com to mysite.com HOT 4
- Dynamic meta info in header section HOT 2
- Logical Error in User Model
- related content HOT 3
- does not work with MySQL HOT 1
- Trying to redirect to another controller... HOT 2
- In php7.2 bug HOT 1
- Demo is throwing error HOT 1
- about comment
- upload an image from admin/post have some error. HOT 1
- trying the demo version with admin user at https://ikkez.de/fabulog/admin/post Gives Internal server Error HOT 2
- Update?
- postgres HOT 2
- How to run custom query like db->exec() in a controller? HOT 3
- What's wrong in repeat loop? HOT 3
- db using HOT 2
- Fatal error when page does not exits HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fabulog.