PHPAML

Documentation · Chapter 08

Prove an action
came from the real form.

A CSRF attack tricks an already signed-in browser into sending an action without its user's knowledge.

We secure reading-list in layers without pretending one option is enough.

The matching-ticket analogy

When opening a form, the server gives the session a secret ticket. On return, the form must present the exact same ticket. Another site can trigger a request but does not know this token.

Add the field to every writing form

phpaml — zsh
<form method="post" action="/books">
    <?= $view->csrfField() ?>
    <!-- champs -->
    <button type="submit">Enregistrer</button>
</form>

The middleware accepts _token in the form or X-CSRF-Token in the header. Without a safe match through hash_equals(), it returns 419 and refreshes the token header.

Which requests are checked?

GET / HEAD / OPTIONSread: no CSRF check
POST / PUT / PATCH / DELETEchange: token required
Authorization: Bearer …token auth, not cookie auth
Configured API prefixesexcluded from Web middleware
CSRF does not replace authorization

A valid token proves form origin, not permission to delete a book. Check identity and permissions too.