schnittstabil/psr7-csrf-middleware

Stateless PSR-7 CSRF (Cross-Site Request Forgery) protection middleware - simple Slim Framework 3 integration.

Psr7\Csrf\Middleware

, _(*1)

Stateless PSR-7 CSRF (Cross-Site Request Forgery) protection middleware :lock_with_ink_pen:, _(*2)

Install

$ composer require schnittstabil/psr7-csrf-middleware

Usage

buildSynchronizerTokenPatternMiddleware();

/*
 * Build a (AngularJS compatible) stateless Cookie-To-Header CSRF proptection middleware.
 *
 * Requires additional dependency:
 *     composer require dflydev/fig-cookies
 */
$csrfMiddleware = CsrfMiddlewareBuilder::create($key)
    ->buildCookieToHeaderMiddleware();
?>

Slim v3 Example

• See csrf-twig-helpers for complete Slim-Twig Examples.

getContainer()['csrf_token_name'] = 'X-XSRF-TOKEN';
$app->getContainer()['csrf'] = function ($c) {
    $key = 'This key is not so secret - change it!';

    return CsrfMiddlewareBuilder::create($key)
        ->buildSynchronizerTokenPatternMiddleware($c['csrf_token_name']);
};
$app->add('csrf');

/*
 * GET routes are not protected (by default)
 */
$app->get('/', function (RequestInterface $request, ResponseInterface $response) {
    $name = $this->csrf_token_name;
    $token = $this->csrf->getTokenService()->generate();

    // render HTML...
    $response = $response->write("");

    return $response->write('successfully GET!');
});

/*
 * POST routes are protected (by default; same applies to PUT, DELETE and PATCH)
 */
$app->post('/', function (RequestInterface $request, ResponseInterface $response) {
    return $response->write('successfully POST');
});

/*
 * Run application
 */
$app->run();
?>

Related

• schnittstabil/csrf-tokenservice – the underlying (stateless) token service
• schnittstabil/csrf-twig-helpers – Twig helpers for token rendering
• Slim-Csrf – stateful (session based) CSRF protection

License

MIT © Michael Mayer, _(*3)