包简介

Slim Framework 3 CSRF protection middleware utilities

README 文档

README

Basically, this package passes CSRF token to view (currently, official Slim Twig and PHP renderers are supported) or in response headers (for AJAX calls).

Installation

Requires Composer

composer require aurmil/slim3-csrf-utilities

Then require Composer autoload file

require 'vendor/autoload.php';

Usage

For an action that needs to display CSRF token in a view, add Aurmil\Slim\CsrfTokenToView middleware before Slim\Csrf\Guard.

For an AJAX called action that needs to return new token to the caller in response headers, add Aurmil\Slim\CsrfTokenToHeaders middleware before Slim\Csrf\Guard.

Let's consider a really light Slim app:

index.php

<?php
// declare usage of needed classes
use Aurmil\Slim\CsrfTokenToView;
use Aurmil\Slim\CsrfTokenToHeaders;

// Composer autoload file
require 'vendor/autoload.php';

// Needed by CSRF component to store token
session_start();

// Slim
$app = new \Slim\App();
$container = $app->getContainer();

// If a route needs a view renderer
$container['renderer'] = function ($c) {
    return new \Slim\Views\Twig(__DIR__, ['cache' => false]); // Twig
    return new \Slim\Views\PhpRenderer(__DIR__.'/'); // Or PHP
};

// CSRF component
$container['csrf'] = function ($c) {
    return new \Slim\Csrf\Guard;
};

// HTML form including fields for CSRF token
$app->get('/', function ($request, $response) {
    return $this->renderer->render($response, 'view.twig'); // Twig
    return $this->renderer->render($response, 'view.php'); // Or PHP
})->add(new CsrfTokenToView($container->csrf, $container->renderer))
    ->add($container->csrf);

// CSRF protected action, can be called by AJAX
$app->post('/submit', function ($request, $response) {
    if ($request->isXhr()) {
        return $response->withJson(['success' => true]);
    } else {
        return $response->withRedirect('/');
    }
})->add(new CsrfTokenToHeaders($container->csrf))
    ->add($container->csrf);

// Slim dispatching
$app->run();

Twig view

<!doctype html>
<html>
    <head>
        <meta charset="utf-8">
        <title>CSRF</title>
    </head>
    <body>
        <form action="/submit" method="post">
            {% if csrf_token is defined and csrf_token %}
                {% for key, value in csrf_token %}
            <input type="hidden" name="{{ key|e('html_attr') }}" value="{{ value|e('html_attr') }}" class="csrf">
                {% endfor %}
            {% endif %}

            <button type="submit">Submit</button>
        </form>

        <!-- for AJAX calls -->
        <script src="http://code.jquery.com/jquery-2.2.1.min.js"></script>
        <script src="main.js"></script>
    </body>
</html>

Or PHP view

<!doctype html>
<html>
    <head>
        <meta charset="utf-8">
        <title>CSRF</title>
    </head>
    <body>
        <form action="/submit" method="post">
            <?php if (isset($csrf_token) and !empty($csrf_token)): ?>
                <?php foreach ($csrf_token as $key => $value): ?>
            <input type="hidden" name="<?php echo $key ?>" value="<?php echo $value ?>" class="csrf">
                <?php endforeach ?>
            <?php endif ?>

            <button type="submit">Submit</button>
        </form>

        <!-- for AJAX calls -->
        <script src="http://code.jquery.com/jquery-2.2.1.min.js"></script>
        <script src="main.js"></script>
    </body>
</html>

JS file (fox AJAX calls) using jQuery

$(function () {
    var form = $('form');
    form.on('submit', function () {
        $.ajax({
            url: form.attr('action'),
            method: form.attr('method'),
            data: form.serialize(),
            cache: false,
            dataType: 'json',
            success: function (data) {
                console.log('OK');
            },
            error: function () {
                console.log('error')
            },
            complete: function (jqXHR) {
                var csrfToken = jqXHR.getResponseHeader('X-CSRF-Token');

                if (csrfToken) {
                    try {
                        csrfToken = $.parseJSON(csrfToken);
                        var csrfTokenKeys = Object.keys(csrfToken);
                        var hiddenFields = form.find('input.csrf[type="hidden"]');

                        if (csrfTokenKeys.length === hiddenFields.length) {
                            hiddenFields.each(function(i) {
                                $(this).attr('name', csrfTokenKeys[i]);
                                $(this).val(csrfToken[csrfTokenKeys[i]]);
                            });
                        }
                    } catch (e) {

                    }
                }
            }
        });

        return false;
    });
});

And .htaccess

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [QSA,L]
</IfModule>

License

The MIT License (MIT). Please see License File for more information.

aurmil/slim3-csrf-utilities 适用场景与选型建议

aurmil/slim3-csrf-utilities 是一款基于 PHP 开发的 Composer 扩展包，目前已累计 1.6k 次下载、GitHub Stars 达 9，最近一次更新时间为 2016 年 03 月 15 日，在 PHP 生态内属于活跃度较高的组件。

它主要适用于以下技术方向：「framework」「middleware」「csrf」「slim」「slimphp」等业务场景。在实际项目中，围绕这些方向常见需要落地的问题包括：接口对接、性能调优、并发安全、与既有框架（Laravel / ThinkPHP / Yii / Webman 等）的兼容适配，以及生产环境的日志埋点与稳定性保障。

我们在过去多个企业项目中使用过 aurmil/slim3-csrf-utilities 或与其功能相近的方案，如果你在选型或落地过程中遇到问题，例如 版本兼容、二次改造、私有化封装、与内部系统对接、生产 BUG 排查，欢迎联系我们协助评估。

围绕 aurmil/slim3-csrf-utilities 我们能提供哪些服务？

定制开发 / 二次开发

基于 aurmil/slim3-csrf-utilities 在你已有业务上做功能扩展、字段裁剪、UI 适配、与内部账号 / 权限 / 日志系统的深度对接。

BUG 修复 & 性能优化

线上偶发问题、内存泄漏、慢查询、并发异常等排查修复；针对高流量场景做缓存、队列、索引层面的调优。

项目外包 & 长期维护

承接完整的项目从需求 → 设计 → 开发 → 上线 → 长期运维；也可按月提供技术保姆服务。

yvsm@zunyunkeji.com QQ：316430983 微信：yvsm316 西安尊云信息科技 · 专注 PHP / Go / 分布式系统研发