UnknownPlayer Posted September 18, 2011 Share Posted September 18, 2011 Hi, i need to know for what is using tokens, for security or ? And if someone can give me some little example ? Thanks.. Link to comment https://forums.phpfreaks.com/topic/247375-token-using/ Share on other sites More sharing options...
trq Posted September 18, 2011 Share Posted September 18, 2011 We are going to need more details/examples. Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270397 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I dont know anything about tokens, i just know that they are used for security, i need some example with form, can you give me ? And session token and hidden field token, and how to get token code.. Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270469 Share on other sites More sharing options...
xyph Posted September 18, 2011 Share Posted September 18, 2011 Tokens must be impossible to predict and there must never be duplicates. If you're new to programming, I suggest using PHP's built in session handler. It will generate tokens for you and manage the server<->user relationship http://php.net/manual/en/session.examples.basic.php Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270483 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I know about sessions, but how can i generate token code ? This is how should token works: id ($_POST['token'] == $_SESSION['token']) to continue ? That is something like security for form post and get action ? Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270487 Share on other sites More sharing options...
xyph Posted September 18, 2011 Share Posted September 18, 2011 Security? I'm not sure what you mean. Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270508 Share on other sites More sharing options...
UnknownPlayer Posted September 18, 2011 Author Share Posted September 18, 2011 I thought that token can save from submiting form from other server to my file with same form and same action file and post method ? Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270510 Share on other sites More sharing options...
xyph Posted September 19, 2011 Share Posted September 19, 2011 No, a token will not prevent an external form submitting to your site. All an attacker would need to do was request your form page, grab the token, insert it into his rouge form and submit as normal. It forces an attacker to take an extra step, but the code required to beat it would take 5 minutes to write. As I said in a previous post (I believe it was by you) there is NO WAY to prevent an external site from submitting a form to your page. You can practically stop automated form submissions by using reCAPTCHA. Link to comment https://forums.phpfreaks.com/topic/247375-token-using/#findComment-1270520 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.