CodeIgniter , Csrf token

问题:

I Have Trouble

View

<form method="post" action="test/csrf">
<input type="hidden" name="<?=$this->security->get_csrf_token_name();?>" value="<?=$this->security->get_csrf_hash();?>">

Controller

echo $this->input->post($this->security->get_csrf_token_name());

I Can't Show Token Code

回答1:

Access the Csrf Token in controller

In controller u can get name and value of csrf as follow

        echo $this->security->get_csrf_token_name(); // for the name
        echo $this->security->get_csrf_hash();  // for the value    

Enable CSRF in Config file

 $config['csrf_regenerate'] = TRUE;

1. Used CSRF Tokens using form helper

We have two way to add CSRF tokens; if we are thinking to update your form with CodeIgniter form helper class then CSRF tokens will automatic added or if you are thinking to adjust in custom form then we need to add custom hidden input name and its value.

When we will use form helper class:

  <?php echo form_open(base_url( 'user/login' ), array( 'id' => 'login', 'class' => 'login' ));?>
      <input type="text" name="username" />
      <input type="password" name="password" />
      <input type="submit" name="submit" value="Submit" />
  <?php echo form_close();?>

Using form helper class will automatically added input filed into the form with a random token value to prevent CSRF.

2. When we use custom form:

We need to add a input filed to prevent our custom form with CSRF.

    $csrf = array(
    'name' => $this->security->get_csrf_token_name(),
    'hash' => $this->security->get_csrf_hash()
    );

     <input type="hidden" name="<?=$csrf['name'];?>" value="<?=$csrf['hash'];?>" />

If you use the form helper, then form_open() will automatically insert a hidden csrf field in your forms. If not,

Then you can use get_csrf_token_name() and get_csrf_hash()

http://www.codeigniter.com/user_guide/libraries/security.html

http://www.sks.com.np/secure-your-codeigniter-application-using-csrf-token/