Re: [RFC DRAFT] Automatic CSRF Protection
| From: | Yasuo Ohgaki | Date: | Wed, 11 May 2016 08:29:48 +0000 |
| Subject: | Re: [RFC DRAFT] Automatic CSRF Protection | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93215@lists.php.net to get a copy of this message | ||
Hi,
Sorry for scattered mails.
On Wed, May 11, 2016 at 5:05 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> What I personally would be for, is a CSRF aPI module that comes as default,
>> like the Password API one, that gives ability to generate good quality CSRF
>> tokens and manage it.
Token generation is automatic, but this RFC supports fully manual CSRF
validation, too. The RFC page only has semi manual example only. I'll
add a example for this.
Anyway, I fails to see the reason why PHP should not invalidate CSRF
attacks against POST requests with 2 simple parameter or INI...
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net