php Codeigniter CSRF - 它是如何工作的
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6244669/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Codeigniter CSRF - how does it work
提问by CyberJunkie
Recently I found out about CSRF attacks and was happy to find out that CSRF protection was added to Codeigniter v 2.0.0.
最近我发现了 CSRF 攻击，并且很高兴地发现 CSRF 保护被添加到 Codeigniter v 2.0.0。
I enabled the feature and saw that a hidden input with a token is added in forms and I assume that it stores the token in a session too. On POST requests does CI automatically compare tokens or do I have have to manually do that?
我启用了该功能，并看到在表单中添加了一个带有令牌的隐藏输入，我假设它也将令牌存储在会话中。在 POST 请求中，CI 是自动比较令牌还是我必须手动比较？
回答by Wesley Murch
The CSRF token is added to the form as a hidden input only when the form_open()function is used.
只有在使用该form_open()函数时，CSRF 令牌才会作为隐藏输入添加到表单中。
A cookie with the CSRF token's value is created by the Security class, and regenerated if necessary for each request.
带有 CSRF 令牌值的 cookie 由 Security 类创建，并在必要时为每个请求重新生成。
If $_POSTdata exists, the cookie is automatically validated by the Input class. If the posted token does not match the cookie's value, CI will show an error and fail to process the $_POSTdata.
如果$_POST数据存在，则输入类会自动验证 cookie。如果发布的令牌与 cookie 的值不匹配，CI 将显示错误并且无法处理$_POST数据。
So basically, it's all automatic - all you have to do is enable it in your $config['csrf_protection']and use the form_open()function for your form.
所以基本上，这都是自动的——你所要做的就是在你的表单中启用它$config['csrf_protection']并使用form_open()你的表单的功能。
A good article I found that explains it very well: https://beheist.com/blog/csrf-protection-in-codeigniter-2-0-a-closer-look.html
我发现一篇很好的文章解释了它：https: //beheist.com/blog/csrf-protection-in-codeigniter-2-0-a-closer-look.html
回答by anil
Refer this Link -- Used CSRF Tokens using form helper or Manually
请参阅此链接 --使用表单助手或手动使用 CSRF 令牌
The article explains how to work around with CSRF Tokens in
这篇文章解释了如何在
- form open with form helper
form_open()function - in ajax forms
- ajax/jquery serialization forms
- 使用表单助手
form_open()功能打开表单 - 以 ajax 形式
- ajax/jquery 序列化表单
This article also explains about how to "Disable CSRF for cetain URL's(Which are used as webservice urls)"
本文还解释了如何“禁用 cetain URL 的 CSRF（用作 web 服务 url）”
回答by Jarek Tkaczyk
When csrf protection enabled security class checks this token automatically (it compares POST token with COOKIE token)
当启用 csrf 保护的安全类自动检查此令牌时（它将 POST 令牌与 COOKIE 令牌进行比较）
