2
\$\begingroup\$

A short script to make a CSRF token to be used in my html elements such as inputs, file-uploads, scripts, iframes & svgs.

<?php 
    session_start();
        if (NULL || empty($_SESSION['csrf_token'])){    // Cross Site Request Forgery ::(Token.). 
            $_SESSION['csrf_token'] = bin2hex(random_bytes(128)) .= md5(md5(1221126789shdncfts653kl));
        }   
?>

Above Is the Old Version that was Posted Last Year, Just Revisited this Project and Added some to to this. Posted Below.

<?php
    error_reporting(E_ALL);

    header('Access-Control-Allow-Origin: *'); // Remove this when Uploaded to live server. only here for CORS Warnings.

    session_start();
     $GuestUsr = "BaseUsr";
      session_register('GuestUsr');

         if (NULL || undefined || empty($_SESSION['csrf_token'])){              // Cross Site Request Forgery ::(Token.). 
             $_SESSION['csrf_token'] = bin2hex(random_bytes(128)).= md5(md5(1221126789shdncfts653kl));
             }                                                      // Shouldn't use MD5 anymore apparently.

        $_SESSION['hits']++;    // Increment a very Basic Page Counter.
        $_SESSION['in_Session'] = '1';

        $_SESSION["is_guest"] = true;
        $_SESSION["loggedIn"] = false;
        $_SESSION["has_priv"] = false;
            if($SESSION["is_guest"] = true){
                $_SESSION["loggedIn"] = false;
            } elseif ($_SESSION["loggedIn"] = true) {
                $_SESSION["is_guest"] = false;
                $_SESSION["has_priv"] = 1;           // Will be different privaledge levels. 1>7...
                };

        $csrf = bin2hex(16);
        $cookie = bin2hex(32);
        $hashish_cookie = bin2hex(64);

        if (isset($_SESSION['loggedIn']) && $_SESSION['loggedIn'] == true) {
            echo "Welcome to the member's area, " . $_SESSION['username'] . "!";
        } else {
            echo "Please log in first to see this page.";
        }

Also Just Downloaded Some generic Code from PhpJabbers, But Noticed when studying there code they have included: @session_start() instead of the normal session_start() that I see everywhere else. Does anybody Know what the @ does? Google or PHP Docs have no reference to this?

Can this be made better? I saw a very complex one using regex but this is my implementation so far.

Having Just Read These Answers: CSRF implementation => SO Quest. I might change it to use: openssl_random_pseudo_bytes(16) or a combination.

Questions that I have which I still don't understand in PHP.

1) Is $_SESSION['Tokens']; a fixed list of variables that I can call upon to do certain jobs? Or can I make my own Up like $_SESSION['MyStoredSumthing']?

2) Are all $_UPPERCASE considered GLOBAL.

3) Currently I have My CSRF & Cookie Codes, in the head of my document, That is included in every single page. Is this bad practice as every time a page is requested its going to be running through my php script & creating or over-riding The CSRF and/or cookie with either the same value or a different new value. if its being stored in the SESSION which makes it available to all subsequent pages. Then calling this php every page load is wrong? is this correct? I'm trying to build my pages more towards MVC but still gotta go through and get rid of all the mysql_functions.

4) Mysql_functions are deprecated. Does this include mysqli?

\$\endgroup\$
  • 1
    \$\begingroup\$ For this purpose I don't think you need such a complex token. Something like random_bytes(16) (64 bits) should be enough. I won't downvote your question, but for Code Review, there is very little code in your question. \$\endgroup\$ – KIKO Software Aug 20 '19 at 19:37
  • \$\begingroup\$ I know. I mainly just put it here because I added The NULL Part and have no way of testing if its NULL What would happen. \$\endgroup\$ – Ryan Stone Aug 20 '19 at 19:39
  • 2
    \$\begingroup\$ The NULL || bit doesn't do anything. You can leave it out. \$\endgroup\$ – KIKO Software Aug 20 '19 at 20:33
  • \$\begingroup\$ @KIKO Software Surely it is better to check whether the value is NULL or Undefined otherwise an attacker could set it to either one of these and then the part of the code that builds the csrf token would never run? ie it would just skip straight past that if statement? No? \$\endgroup\$ – Ryan Stone yesterday
  • \$\begingroup\$ No. There is no check when you use NULL || or undefined ||. They represent constant values which will always evaluate to FALSE. So when you say: NULL || undefined || empty($_SESSION['csrf_token']), you could as well say: FALSE || FALSE || empty($_SESSION['csrf_token']), or shorter: empty($_SESSION['csrf_token']). \$\endgroup\$ – KIKO Software yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.