Should check csrf in forms? about fabulog HOT 5 OPEN

The Session class is a Cache-Based Session handler, which requires to have an activated Cache instance.

$f3->set('CACHE', true);
$s = new Session();
echo $s->csrf(); // z3sysduecint.p63g18fr7nvp

Though the Session handlers have some build in protection already, they only help you for Session-Hijacking attacks. You are right, for better security, this token should be used in forms or URIs that we want to protect.

if ($f3->exists('SESSION.csrf',$csrf))
    var_dump($csrf); // old token from last request, to validate forms
$s = new Session();
$newToken = $s->csrf(); // token for current request, use this in hidden form fields
var_dump($newToken);
$f3->set('SESSION.csrf',$newToken);

I currently have no such check in fabulog, but will consider to add this as feature. thanks ;)

edit: I've added this to the docs. http://fatfreeframework.com/session#csrf

from fabulog.

Thanks for your reply.

I know where I got error.

if I test code like this:

$f3=require('lib/base.php');
$f3->set('CACHE',true);
if (true) {
     /*do_login*/
    $session = new Session();
    $f3->set('SESSION.user_id',3);  //
    $f3->set('SESSION.csrf',$session->csrf());
    var_dump($f3->get('SESSION'));
}

every thing is right.
But this gets the error:

$f3=require('lib/base.php');
$f3->set('CACHE',true);
if (true) {
    /*do_login*/
    $f3->clear('SESSION');   //this line added
    $session = new Session();
    $f3->set('SESSION.user_id',3);  
    $f3->set('SESSION.csrf',$session->csrf());
    var_dump($f3->get('SESSION'));
    //csrf token is false
}

from fabulog.

When a user login, should clear session first? Then can't get csrf token?

from fabulog.

It seems that the token is created when the session instance is create. The Session class check if other session data has exists, if not, the token won't be saved.
I add a method to the Session class to generate the token, and save it. Call the method when needed.

from fabulog.

i keep getting this error
"session_start(): Failed to read session data: user"
the csrf code gets generated but then the website won't work because that error 500, it's driving me crazy :S

from fabulog.