CSRF token validation

[jmb272]

Hi all,

 

I'm writing my own MVC framework purely to improve my oo php skills and I've created a CSRF token validation class to help prevent CSRF attacks.

 

I just need some feedback on it really, is it insecure, is there a better way to validate tokens, etc.

 

<?php

// Security measure.
if (!defined('BASE_PATH')) { exit(); }

class CSRF
{
private static $tokens = array();
private static $session_name = 'csrf_data';

/**
 * Loads CSRF token data from session into $tokens array.
 *
 * This is called before the controller is loaded.
 *
 * @return void
 */
public static function init()
{
	$session_name = self::$session_name;

	// Move CSRF token data from session to class field.
	if (isset($_SESSION[$session_name])) {
		self::$tokens = unserialize($_SESSION[$session_name]);	
		unset($_SESSION[$session_name]);
	}
}

/**
 * Saves the CSRF data to a session.
 *
 * @static
 * @return void
 */
private static function save() 
{
	$session_name = self::$session_name;
	unset($_SESSION[$session_name]);

	$_SESSION[$session_name] = serialize(self::$tokens);
}

/**
 * Creates a new token.
 *
 * @static
 * @param string $name
 * @return string
 */
private static function generateToken($name)
{
	$token = md5(uniqid(rand(), true));

	self::$tokens[$name] = $token;
	self::save();

	return $token;
}

/**
 * Validate a token by its name.
 *
 * @static
 * @param string $name
 * @param string $token The CSRF token included with the form data.
 * @return bool
 */
public static function validateToken($name, $token)
{
	if (!isset(self::$tokens[$name])) {
		return false;
	}

	return ($token == self::$tokens[$name]);
}


} // End of CSRF class.

[scootstah]

Usually this is done with cookies, with an expiration time of say 2 hours or something...so that you don't have to regenerate a token on every request. The main advantage of this is what if someone submits a form, and then refreshes and resubmits? Since it's a new request, you'd have a different token and it wouldn't work - and to me, this is extremely irritating. There are times when you want to resubmit a form.

[jmb272]

Usually this is done with cookies, with an expiration time of say 2 hours or something...so that you don't have to regenerate a token on every request. The main advantage of this is what if someone submits a form, and then refreshes and resubmits? Since it's a new request, you'd have a different token and it wouldn't work - and to me, this is extremely irritating. There are times when you want to resubmit a form.

 

Say you have a contact form on your website and the user fills it out, submits it and it sends you a message.

Now say if that user was a bit of a d*ck and decided to repeatedly refresh the page to spam your inbox, that wouldn't be possible with a different csrf token being generated each time the page is loaded.

[scootstah]

True, but there are other ways to prevent duplicate form submissions.

 

What about AJAX forms? Using AJAX would change the CSRF token in the session but not the form, and then it wouldn't be valid.