Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93261
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.51 as permitted sender)
To: internals@lists.php.net
References: <CAGa2bXZytbD1H-Rg5eWfiPwEM0p47JSQH-GC-ZayDSLbmbsGVA@mail.gmail.com>
 <c21d1d4b-a790-e1a9-7c93-2c5af4baf5d1@gmail.com>
 <CAGa2bXboop3KDFnYtcdO-K+hL0To5te_yeHeFEFO-kCVuzNOJQ@mail.gmail.com>
 <3b115b37-d399-0b69-24b4-de5c95c4a069@gmail.com>
 <CAGa2bXZwRK0GuXbT53B4w+h5ySiVJnJpo-d87Uiw-reYHi80zQ@mail.gmail.com>
 <CANUQDChxOeydBRLPrvuumf+edqJNKV+TOstGz66X_tg+Y7knPQ@mail.gmail.com>
 <CAGa2bXZC8Qp8-Ggyfj5+0X5aiktSX_AyfRdKAPXFZ=x4+A1XDQ@mail.gmail.com>
 <CANUQDCgi-P4=rWA5H+53_BcWyqeWaC_QOADUNMb_jV70KuhEPw@mail.gmail.com>
 <CAL0xaBFTF28h7ZTCkk=gn2=kepv0xe_Gk0+zjhmZzDmLJYU3-w@mail.gmail.com>
 <CAGa2bXbX_YhpJEr+9XjTb3xxgb2KTw=LEjC97A0vM4_WNiSvnA@mail.gmail.com>
 <CAGa2bXZrqvzNSQY=f3xM-czo4bAFZSF4cN0xLpBo6V0K91bivQ@mail.gmail.com>
 <ae235ace-7d9c-8b75-ed5a-10f1f264dfd5@gmail.com>
Message-ID: <0e99dcee-44d9-053e-f4e8-4270f3e616c9@gmail.com>
Date: Thu, 12 May 2016 09:55:46 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.0
MIME-Version: 1.0
In-Reply-To: <ae235ace-7d9c-8b75-ed5a-10f1f264dfd5@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC DRAFT] Automatic CSRF Protection
From: rowan.collins@gmail.com (Rowan Collins)

On 11/05/2016 13:29, Rowan Collins wrote:
> Thinking about it, the only part that has some value being in core is
> the HTML rewriting. Perhaps what is actually needed is a lower-level
> function that PHP libraries can use to hook into this with whatever
> parameters they want, e.g.
>
> register_html_rewrite_callback(
>     function() { return [ 'csrf_token' => MyFramework\CSRF::getToken()
> ]; },
>     REWRITE_POST_FORMS | REWRITE_URL
> );

I realised I over-complicated this, all you need is:

# ob_add_rewrite_param(array $fields, int $flags)

ob_add_rewrite_param( [ 'csrf_token' => MyFramework\CSRF::getToken() ], 
REWRITE_POST_FORMS | REWRITE_URL_LINKS );


That said, this - and the CSRF mechanism as currently proposed - rely 
heavily on the quality of that output rewriting engine. I've never used 
it, so have no idea how well it actually works with a modern application.

Regards,
-- 
Rowan Collins
[IMSoP]