I am using codeigniter framework in PHP. In signup form
I have:
Controller:
$info['csrf_token'] = array('signup'=>$this->csrf_token('signup'));
echo $this->load->view('/signup',$info,TRUE);
// generate token:
public function csrf_token($form_name){
if (function_exists('mcrypt_create_iv')) {
$t = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
} else {
$t = bin2hex(openssl_random_pseudo_bytes(32));
}
$sess_array = array();
$sess_array[$form_name] = $t;
$this->session->set_userdata('csrf', $sess_array);
return $t;
}
View:
<form>
<input type="hidden" name="csrf_token" value="<?=hash_hmac('sha256', 'signup', $csrf_token['signup'])?>" />
</form>
Validation check on form submit:
$csrf_sess = $this->session->userdata('csrf');
if(hash_hmac('sha256', 'signup', $csrf_sess['signup'])==$_POST['csrf_token']){
return true; // Valid request.
}else{
return false;
}
Will it prevent website from CSRF (Cross-Site Request Forgery)?