UnknownPlayer Posted September 18, 2011 Share Posted September 18, 2011 Hi, i need to know for what is using tokens, for security or ? And if someone can give me some little example ? Thanks.. Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/ Share on other sites More sharing options...
trq Posted September 18, 2011 Share Posted September 18, 2011 We are going to need more details/examples. Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270397 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I dont know anything about tokens, i just know that they are used for security, i need some example with form, can you give me ? And session token and hidden field token, and how to get token code.. Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270469 Share on other sites More sharing options...
xyph Posted September 18, 2011 Share Posted September 18, 2011 Tokens must be impossible to predict and there must never be duplicates. If you're new to programming, I suggest using PHP's built in session handler. It will generate tokens for you and manage the server<->user relationship http://php.net/manual/en/session.examples.basic.php Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270483 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I know about sessions, but how can i generate token code ? This is how should token works: id ($_POST['token'] == $_SESSION['token']) to continue ? That is something like security for form post and get action ? Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270487 Share on other sites More sharing options...
xyph Posted September 18, 2011 Share Posted September 18, 2011 Security? I'm not sure what you mean. Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270508 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I thought that token can save from submiting form from other server to my file with same form and same action file and post method ? Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270510 Share on other sites More sharing options...
xyph Posted September 19, 2011 Share Posted September 19, 2011 No, a token will not prevent an external form submitting to your site. All an attacker would need to do was request your form page, grab the token, insert it into his rouge form and submit as normal. It forces an attacker to take an extra step, but the code required to beat it would take 5 minutes to write. As I said in a previous post (I believe it was by you) there is NO WAY to prevent an external site from submitting a form to your page. You can practically stop automated form submissions by using reCAPTCHA. Quote Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270520 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.