PHP CSRF Protection with Synchronizer Tokens

Generate a per-session random synchronizer token and verify it before accepting a state-changing request.

The examples introduce the underlying control before showing a verification and an application-level safeguard.

What You Will Build

Generate a per-session random synchronizer token and verify it before accepting a state-changing request.

Prerequisites

Use PHP 8.4 or newer, HTTPS for all authentication operations, and an application session or database where required. Example configuration values are placeholders, never production secrets.

Example 1: Basic Operation

Render a random synchronizer token inside a state-changing form.

<?php
session_start();
$_SESSION['csrf'] ??= bin2hex(random_bytes(32));
echo '<input type="hidden" name="csrf" value="' . htmlspecialchars($_SESSION['csrf'], ENT_QUOTES, 'UTF-8') . '">';

Example 2: A Different Use Case

Reject absent and mismatched POST tokens before changing state.

<?php
session_start();
$expected = $_SESSION['csrf'] ?? '';
$received = $_POST['csrf'] ?? '';
if (!is_string($received) || !is_string($expected) || $expected === '' || !hash_equals($expected, $received)) {
    http_response_code(403); exit('Request rejected');
}
// The validated POST request may now reach the application handler.

Practical Example: Checking the Result

Layer token checks with the HTTP method and authenticated session.

<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { http_response_code(405); exit; }
$token = $_POST['csrf'] ?? null;
if (!is_string($token) || empty($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], $token)) {
    http_response_code(403); exit;
}
// Keep an authenticated session and server-side authorization checks.

Important Behavior and Edge Cases

Ensure the session is started, use POST for writes, and do not rely on a token that is sent only in a cookie.

Enforce controls on the server, test denial paths and do not assume that a snippet alone implements an entire production workflow.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• Generate a per-session random synchronizer token and verify it before accepting a state-changing request.
• Ensure the session is started, use POST for writes, and do not rely on a token that is sent only in a cookie.
• A synchronizer token differs from the signed double-submit cookie pattern used by stateless systems.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.