Understanding CSRF Attacks in PHP

Protect state-changing cookie-authenticated requests from cross-site request forgery. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Protect state-changing cookie-authenticated requests from cross-site request forgery.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

The first example isolates the core operation so its result is easy to understand.

<?php
session_start();
$_SESSION['csrf'] ??= bin2hex(random_bytes(32));
echo '<input type="hidden" name="csrf" value="' . htmlspecialchars($_SESSION['csrf'], ENT_QUOTES, 'UTF-8') . '">';

Example 2: Alternative or Failure Case

The second example demonstrates an alternative outcome, rule or failure condition.

<?php
session_start();
$expected = $_SESSION['csrf'] ?? '';
$provided = (string) ($_POST['csrf'] ?? '');
$valid = $expected !== '' && hash_equals($expected, $provided);
http_response_code($valid ? 200 : 403);

Practical Example: Applying the Rule

The practical example shows how to carry the same constraint into application code.

<?php
session_start();
$sent = (string) ($_POST['csrf'] ?? '');
if (!isset($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], $sent)) { http_response_code(403); exit('Invalid token'); }
unset($_SESSION['csrf']);
echo 'One-time CSRF token consumed';

Important Behavior and Edge Cases

A CSRF token must be bound to the user's session and checked with hash_equals; SameSite alone may not cover all cases.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Protect state-changing cookie-authenticated requests from cross-site request forgery.
• A CSRF token must be bound to the user's session and checked with hash_equals; SameSite alone may not cover all cases.
• Authentication proves the session but not the origin or intent of a submitted form.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.