CSRF protection

[mikaelz]

It would be handy to add CSRF examples.
I was just making a CSRF protection https://gist.github.com/mikaelz/5668195 inspired from http://stackoverflow.com/a/10469574/289404

[philsturgeon]

Absolutely dude. Would you like to start putting this stuff together as a Pull Request, then we can talk through it.

[jasondavis]

I request that if you do add this, that you use proper Syntax like PSR compliant and not the shorthand Python(y) way

[philsturgeon]

Yes, I forgot to mention that. PSR-2 is being used for most of our examples.

Phil Sturgeon

On Wednesday, May 29, 2013 at 12:39 PM, Jason Davis wrote:

I request that if you do add this, that you use proper Syntax like PSR compliant and not the shorthand Python(y) way

—
Reply to this email directly or view it on GitHub (#272 (comment)).

[mikaelz]

I'm no professional in this area, that's why I mentioned it.

[dragoonis]

For strong randomisation for CSRF keys, we use
openssl_random_pseudo_bytes() in PPI Framework.
https://github.com/ppi/website/blob/master/modules/UserModule/Controller/Auth.php#L77

I recommend you use this instead of the uniqid() method.

On Wed, May 29, 2013 at 8:07 PM, Michal Zuber notifications@github.comwrote:

I'm no professional in this area, that's why I mentioned it.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/272#issuecomment-18638944
.

[philsturgeon]

Thats cool we're all learning. Put something together and we'll all help out, like Paul there. I'll throw in too.

Phil Sturgeon

On Wednesday, May 29, 2013 at 3:07 PM, Michal Zuber wrote:

I'm no professional in this area, that's why I mentioned it.

—
Reply to this email directly or view it on GitHub (#272 (comment)).

[dragoonis]

Hi @philsturgeon,

Is there a template for another piece of functionality that could be cloned and we put the CSRF related stuff in it.

I'm happy to help draft stuff up if you can give a little nudge here I've not committed to php-the-right-way yet.

[philsturgeon]

Take a look at password hashing, its in the right section and has a code example you can use for this new section.

[mikaelz]

Thanks @dragoonis I added your suggestion ;)

[philsturgeon]

@dragoonis how's this coming along? If its early stage I'll be happy to close this down and talk on a PR instead.

[pixeloution]

I'd suggested to someone he check this project about CSRF and he linked me back this page; is this still being worked on?

[dragoonis]

Hey @philsturgeon i didn't get this notification, sorry.
I had something cooked up but since it's been so long I don't know where it is anymore.

I'm just happy that you switched to using openssl_random_pseudo_bytes() as per my previous comment.

Thanks!

[philsturgeon]

@dragoonis do you want to take responsibility of trying to find it or remake it, or are you giving up? :)

[pixeloution]

@philsturgeon @dragoonis If @dragoonis doesn't have the time/original files, I could make a run at it - you know, for the inevitable fame and riches that comes from writing for Open Source.

[philsturgeon]

Don't forget all the women who will be throwing themselves at you.

—
Sent from Mailbox for iPhone

On Wed, Oct 9, 2013 at 3:31 PM, pixeloution notifications@github.com
wrote:

@philsturgeon @dragoonis If @dragoonis doesn't have the time/original files, I could make a run at it - you know, for the inevitable fame and riches that comes from writing for Open Source.

Reply to this email directly or view it on GitHub:
#272 (comment)