Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93184
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <fc0c78c6-744e-08bb-5ed2-b957458ea3e0@gmail.com>
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
 <c21d1d4b-a790-e1a9-7c93-2c5af4baf5d1@gmail.com> <CAGa2bXboop3KDFnYtcdO-K+hL0To5te_yeHeFEFO-kCVuzNOJQ@mail.gmail.com>
 <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com> <CAGa2bXZwRK0GuXbT53B4w+h5ySiVJnJpo-d87Uiw-reYHi80zQ@mail.gmail.com>
 <fc0c78c6-744e-08bb-5ed2-b957458ea3e0@gmail.com>
Date: Wed, 11 May 2016 10:17:10 +0900
Message-ID: <CAGa2bXZbpdaHDakds6-K-rEjO+zcS9oWuVoD24WBxFDs9-ZJRQ@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Wed, May 11, 2016 at 7:58 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>>> Add where? And where that value would come from? RFC says nothing about
>>> that.
>>
>> As usual. Query parameter when GET is used. Additional input when POST
>> is used. All users have to do is adding CSRF token to JS program.
>
> GET and POST aren't the only HTTP methods. And where JS program would
> get the correct token from? As far as I can see, there's no function in
> the RFC that produces it.

JS code that does not have pages at all may obtain CSRF token manually.

get_csrf_token.php
<?php
session_start(['csrf_protection'=>SESSION_CSRF_GET]);
echo json_encode(['SESSCSRF'=>SESSCSRF]);
?>

then JS apps may use the token. Users must be careful for CSRF token TTL.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net