Csrf Class Reference

Static Public Member Functions
static	generateToken ()
static	getStats ()
static	getToken ()
static	getTokenField ()
static	getTokenMeta ()
static	init ()
static	regenerateToken ()
static	validateOrDie ($removeAfterValidation=false)
static	validateRequest ($removeAfterValidation=false)
static	validateToken ($token, $removeAfterValidation=false)

Data Fields
const	MAX_TOKENS = 10
const	SESSION_KEY = 'bearsampp_csrf_tokens'
const	TOKEN_EXPIRATION = 7200

Static Private Member Functions
static	cleanupExpiredTokens ()
static	configureSession ()
static	getAllHeaders ()
static	getAllowedHosts ()
static	getOriginPort (array $parts, $scheme)
static	getRequestPort ($httpHost, $scheme)
static	isAllowedOrigin ($url, $httpHost, $scheme, array $allowedHosts)
static	isHostAllowed ($host, array $allowedHosts)
static	normalizeHost ($host)
static	validateOrigin ()

Detailed Description

Class Csrf

Provides CSRF (Cross-Site Request Forgery) protection for the Bearsampp application. This class handles token generation, validation, and management to prevent CSRF attacks.

Features:

• Secure token generation using cryptographically secure random bytes
• Session-based token storage
• Token expiration (default: 2 hours)
• Token regeneration for enhanced security
• Automatic cleanup of expired tokens

Usage:

// Generate and get token for forms/AJAX
$token = Csrf::getToken();
 
// Validate token from request
if (!Csrf::validateToken($_POST['csrf_token'])) {
    die('CSRF validation failed');
}

Definition at line 34 of file class.csrf.php.

Member Function Documentation

cleanupExpiredTokens()

cleanupExpiredTokens ( )

staticprivate

Removes expired tokens from the session.

Returns

int Number of tokens removed

Definition at line 606 of file class.csrf.php.

    {
        if (!isset($_SESSION[self::SESSION_KEY])) {
            return 0;
        }
 
        $removed     = 0;
        $currentTime = time();
 
        foreach ($_SESSION[self::SESSION_KEY] as $token => $timestamp) {
            if ($currentTime - $timestamp > self::TOKEN_EXPIRATION) {
                unset($_SESSION[self::SESSION_KEY][$token]);
                $removed++;
            }
        }
 
        if ($removed > 0) {
            Log::debug("Cleaned up $removed expired CSRF tokens");
        }
 
        return $removed;
    }

References Log\debug().

Referenced by init().

Here is the call graph for this function:

Here is the caller graph for this function:

configureSession()

configureSession ( )

staticprivate

Hardens the session configuration before a session is started. These settings are also present in the bundled php.ini, but are applied here as defense in depth in case that file is customized.

Returns

void

Definition at line 84 of file class.csrf.php.

    {
        // Only relevant before the session has been started
        if (session_status() !== PHP_SESSION_NONE || session_id() !== '') {
            return;
        }
 
        $secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
 
        session_set_cookie_params([
            'lifetime' => 0,
            'path'     => '/',
            'secure'   => $secure,
            'httponly' => true,
            'samesite' => 'Strict'
        ]);
 
        ini_set('session.use_only_cookies', '1');
        ini_set('session.use_strict_mode', '1');
    }

Referenced by init().

Here is the caller graph for this function:

generateToken()

generateToken ( )

static

Generates a new CSRF token and stores it in the session.

Returns

string The generated CSRF token

Exceptions

Exception

If random_bytes() fails

Definition at line 111 of file class.csrf.php.

    {
        self::init();
 
        // Fail closed: never fall back to weak randomness. random_bytes()
        // throws if no secure source of entropy is available.
        $token = bin2hex(random_bytes(32));
 
        // Store token with timestamp
        $_SESSION[self::SESSION_KEY][$token] = time();
 
        // Limit number of stored tokens
        if (count($_SESSION[self::SESSION_KEY]) > self::MAX_TOKENS) {
            // Remove oldest token
            $oldestToken = array_key_first($_SESSION[self::SESSION_KEY]);
            unset($_SESSION[self::SESSION_KEY][$oldestToken]);
        }
 
        // Log token generation without exposing token material
        Log::debug('CSRF token generated successfully');
 
        return $token;
    }

References Log\debug(), and init().

Referenced by getToken(), and regenerateToken().

Here is the call graph for this function:

Here is the caller graph for this function:

getAllHeaders()

getAllHeaders ( )

staticprivate

Gets all HTTP headers in a cross-compatible way. Works with both Apache and FastCGI/CGI environments.

Returns

array Associative array of headers

Definition at line 573 of file class.csrf.php.

    {
        // Use getallheaders() if available (Apache)
        if (function_exists('getallheaders')) {
            $headers = getallheaders();
            if ($headers !== false) {
                return $headers;
            }
        }
 
        // Fallback for FastCGI/CGI environments
        $headers = [];
        foreach ($_SERVER as $key => $value) {
            // Extract HTTP headers from $_SERVER
            if (substr($key, 0, 5) === 'HTTP_') {
                // Convert HTTP_X_CSRF_TOKEN to X-Csrf-Token
                $headerName           = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($key, 5)))));
                $headers[$headerName] = $value;
            } // Handle CONTENT_TYPE and CONTENT_LENGTH specially
            elseif (in_array($key, ['CONTENT_TYPE', 'CONTENT_LENGTH'])) {
                $headerName           = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', $key))));
                $headers[$headerName] = $value;
            }
        }
 
        return $headers;
    }

Referenced by validateRequest().

Here is the caller graph for this function:

getAllowedHosts()

getAllowedHosts ( )

staticprivate

Builds the allowlist of hosts the local server is intended to serve. Keeps DNS-rebinding protection effective while still allowing access through the machine hostname and any user-configured virtual hosts.

Returns

array List of allowed, normalized host names.

Definition at line 311 of file class.csrf.php.

    {
        $allowed = array('localhost', APP_LOCALHOST, '[::1]', '::1');
 
        // The local address this very request was received on. This is the
        // reachable address (e.g. a LAN IP) clients use when the application
        // has been put online, so requests addressed to the server's own
        // reachable addresses must be accepted.
        if (isset($_SERVER['SERVER_ADDR'])) {
            $serverAddr = self::normalizeHost((string)$_SERVER['SERVER_ADDR']);
            if ($serverAddr !== '') {
                $allowed[] = $serverAddr;
            }
        }
 
        $hostname = function_exists('gethostname') ? @gethostname() : false;
        if ($hostname !== false && $hostname !== '') {
            $allowed[] = self::normalizeHost($hostname);
        }
 
        global $bearsamppConfig;
        if (is_object($bearsamppConfig) && method_exists($bearsamppConfig, 'getHostname')) {
            $cfgHostname = $bearsamppConfig->getHostname();
            if (is_string($cfgHostname) && $cfgHostname !== '') {
                $allowed[] = self::normalizeHost($cfgHostname);
            }
        }
 
        global $bearsamppBins;
        if (is_object($bearsamppBins) && method_exists($bearsamppBins, 'getApache')) {
            try {
                $apache = $bearsamppBins->getApache();
                if (is_object($apache) && method_exists($apache, 'getVhosts')) {
                    $vhostNames = array();
                    foreach ($apache->getVhosts() as $vhost) {
                        if (is_string($vhost) && $vhost !== '') {
                            $vhostNames[] = $vhost;
                        }
                    }
 
                    // Resolve the actual host names each vhost config serves.
                    // Relying on the config file names alone would miss ServerAlias
                    // entries and hosts that differ from the file name, which would
                    // wrongly reject legitimate requests when HTTPS (secure Apache
                    // settings) is used.
                    $parsedHosts = array();
                    $vhostsPath  = Path::getVhostsPath();
                    if (is_dir($vhostsPath)) {
                        foreach ($vhostNames as $vhost) {
                            $content = @file_get_contents($vhostsPath . '/' . $vhost . '.conf');
                            if ($content === false) {
                                // Fall back to the config file name when it cannot be read
                                $parsedHosts[] = $vhost;
                                continue;
                            }
 
                            $found = false;
                            foreach (array('ServerName', 'ServerAlias') as $directive) {
                                if (preg_match_all('/^\s*' . $directive . '\s+([^\s#]+)/mi', $content, $matches)) {
                                    foreach ($matches[1] as $declaredHost) {
                                        $normalized = self::normalizeHost($declaredHost);
                                        if ($normalized !== '') {
                                            $parsedHosts[] = $normalized;
                                            $found         = true;
                                        }
                                    }
                                }
                            }
 
                            // Keep the file name when the config declares no host name
                            if (!$found) {
                                $parsedHosts[] = $vhost;
                            }
                        }
                    }
 
                    foreach (array_unique($parsedHosts) as $vhost) {
                        $allowed[] = $vhost;
                        // Vhost certificates cover any subdomain (e.g. www.vhost.local),
                        // so those hosts must be accepted as well.
                        $allowed[] = '*.' . $vhost;
                    }
                }
            } catch (\Throwable $e) {
                // Host discovery must never break CSRF validation
                Log::warning('CSRF validation failed: Unable to read virtual hosts: ' . $e->getMessage());
            }
        }
 
        return array_values(array_unique($allowed));
    }

References $bearsamppBins, $bearsamppConfig, APP_LOCALHOST, Path\getVhostsPath(), normalizeHost(), and Log\warning().

Referenced by validateOrigin().

Here is the call graph for this function:

Here is the caller graph for this function:

getOriginPort()

getOriginPort ( array $parts, $scheme )

staticprivate

Resolves the effective port of an Origin/Referer URL, falling back to the default port of the scheme when none is explicitly present.

Parameters

array	$parts	The parsed URL components.
string	$scheme	The origin scheme ('http' or 'https').

Returns

int The effective port.

Definition at line 540 of file class.csrf.php.

    {
        if (isset($parts['port']) && is_numeric($parts['port'])) {
            return (int)$parts['port'];
        }
 
        return $scheme === 'https' ? 443 : 80;
    }

getRequestPort()

getRequestPort ( $httpHost, $scheme )

staticprivate

Resolves the effective port of the request from the HTTP_HOST header, falling back to the default port of the scheme when none is present.

Parameters

string	$httpHost	The raw HTTP_HOST header (may include a port).
string	$scheme	The request scheme ('http' or 'https').

Returns

int The effective port.

Definition at line 558 of file class.csrf.php.

    {
        if (preg_match('/:(\d+)$/', $httpHost, $matches)) {
            return (int)$matches[1];
        }
 
        return $scheme === 'https' ? 443 : 80;
    }

getStats()

getStats ( )

static

Gets statistics about current CSRF tokens. Useful for debugging and monitoring.

Returns

array Statistics about tokens

Definition at line 698 of file class.csrf.php.

    {
        self::init();
 
        $tokens      = $_SESSION[self::SESSION_KEY] ?? [];
        $currentTime = time();
        $expired     = 0;
        $valid       = 0;
 
        foreach ($tokens as $timestamp) {
            if ($currentTime - $timestamp > self::TOKEN_EXPIRATION) {
                $expired++;
            } else {
                $valid++;
            }
        }
 
        return [
            'total'              => count($tokens),
            'valid'              => $valid,
            'expired'            => $expired,
            'max_tokens'         => self::MAX_TOKENS,
            'expiration_seconds' => self::TOKEN_EXPIRATION
        ];
    }

References init().

Here is the call graph for this function:

getToken()

getToken ( )

static

Gets the current CSRF token, generating a new one if none exists.

Returns

string The CSRF token

Definition at line 140 of file class.csrf.php.

    {
        self::init();
 
        // If no tokens exist, generate one
        if (empty($_SESSION[self::SESSION_KEY])) {
            return self::generateToken();
        }
 
        // Return the most recent token
        $tokens = $_SESSION[self::SESSION_KEY];
        end($tokens);
        $latestToken = key($tokens);
 
        // Check if latest token is expired
        if (time() - $tokens[$latestToken] > self::TOKEN_EXPIRATION) {
            // Generate new token if expired
            return self::generateToken();
        }
 
        return $latestToken;
    }

References generateToken(), and init().

Referenced by getTokenField(), and getTokenMeta().

Here is the call graph for this function:

Here is the caller graph for this function:

getTokenField()

getTokenField ( )

static

Gets the token as a hidden input field for forms.

Returns

string HTML hidden input field

Definition at line 651 of file class.csrf.php.

    {
        $token = self::getToken();
 
        return '<input type="hidden" name="csrf_token" value="' . htmlspecialchars($token, ENT_QUOTES, 'UTF-8') . '">';
    }

References getToken().

Here is the call graph for this function:

getTokenMeta()

getTokenMeta ( )

static

Gets the token as a meta tag for inclusion in HTML head. Useful for AJAX requests.

Returns

string HTML meta tag

Definition at line 664 of file class.csrf.php.

    {
        $token = self::getToken();
 
        return '<meta name="csrf-token" content="' . htmlspecialchars($token, ENT_QUOTES, 'UTF-8') . '">';
    }

References getToken().

Here is the call graph for this function:

init()

init ( )

static

Initializes the CSRF protection system. Starts the session if not already started and cleans up expired tokens.

Returns

void

Definition at line 58 of file class.csrf.php.

    {
        // Harden session settings before the session is started
        self::configureSession();
 
        // Start session if not already started
        if (session_status() === PHP_SESSION_NONE) {
            session_start();
        }
 
        // Initialize token storage if not exists
        if (!isset($_SESSION[self::SESSION_KEY])) {
            $_SESSION[self::SESSION_KEY] = [];
        }
 
        // Clean up expired tokens
        self::cleanupExpiredTokens();
    }

References cleanupExpiredTokens(), and configureSession().

Referenced by generateToken(), getStats(), getToken(), regenerateToken(), and validateToken().

Here is the call graph for this function:

Here is the caller graph for this function:

isAllowedOrigin()

isAllowedOrigin ( $url, $httpHost, $scheme, array $allowedHosts )

staticprivate

Checks that an Origin/Referer URL belongs to an allowed host and matches the scheme, host and effective port the request was addressed to.

Parameters

string	$url	The Origin or Referer header value.
string	$httpHost	The raw HTTP_HOST header (may include a port).
string	$scheme	The request scheme ('http' or 'https').
array	$allowedHosts	The allowlist of permitted hosts.

Returns

bool True if the origin is allowed, false otherwise.

Definition at line 475 of file class.csrf.php.

    {
        $parts = parse_url($url);
        if ($parts === false || empty($parts['host'])) {
            Log::warning('CSRF validation failed: Unparseable Origin/Referer header');
 
            return false;
        }
 
        // Reject URLs carrying credentials (userinfo). Real browser Origins
        // never contain them, so this is purely defense in depth.
        if (isset($parts['user']) || isset($parts['pass'])) {
            Log::warning('CSRF validation failed: Origin/Referer header must not contain credentials');
 
            return false;
        }
 
        $originScheme = isset($parts['scheme']) ? strtolower($parts['scheme']) : '';
        if (!in_array($originScheme, array('http', 'https'), true)) {
            Log::warning('CSRF validation failed: Unsupported Origin/Referer scheme "' . $originScheme . '"');
 
            return false;
        }
 
        $originHost = self::normalizeHost($parts['host']);
        if (!self::isHostAllowed($originHost, $allowedHosts)) {
            Log::warning('CSRF validation failed: Origin/Referer host "' . $originHost . '" is not an allowed host');
 
            return false;
        }
 
        // The scheme of the origin must match the scheme the request was made over
        if ($originScheme !== $scheme) {
            Log::warning('CSRF validation failed: Origin/Referer scheme "' . $originScheme . '" does not match request scheme "' . $scheme . '"');
 
            return false;
        }
 
        // The origin host must match the host the request was addressed to
        $requestHost = self::normalizeHost($httpHost);
        if ($originHost !== $requestHost) {
            Log::warning('CSRF validation failed: Origin/Referer host "' . $originHost . '" does not match request host "' . $requestHost . '"');
 
            return false;
        }
 
        // The effective port of the origin must match the request port
        if (self::getOriginPort($parts, $originScheme) !== self::getRequestPort($httpHost, $scheme)) {
            Log::warning('CSRF validation failed: Origin/Referer port mismatch');
 
            return false;
        }
 
        return true;
    }

References normalizeHost(), and Log\warning().

Referenced by validateOrigin().

Here is the call graph for this function:

Here is the caller graph for this function:

isHostAllowed()

isHostAllowed ( $host, array $allowedHosts )

staticprivate

Checks whether a host is allowed, either by exact match against the allowlist or as a subdomain of an allowed wildcard host (e.g. www.vhost.local matches *.vhost.local). Wildcards mirror the certificate coverage BearSampp generates for virtual hosts.

Parameters

string	$host	The raw host to check.
array	$allowedHosts	The allowlist of normalized hosts and wildcards.

Returns

bool True if the host is allowed, false otherwise.

Definition at line 414 of file class.csrf.php.

    {
        $host = self::normalizeHost($host);
        if ($host === '') {
            return false;
        }
 
        if (in_array($host, $allowedHosts, true)) {
            return true;
        }
 
        foreach ($allowedHosts as $allowedHost) {
            if (strpos($allowedHost, '*.') === 0) {
                $suffix = substr($allowedHost, 1);
                if ($suffix !== '' && substr($host, -strlen($suffix)) === $suffix) {
                    return true;
                }
            }
        }
 
        return false;
    }

References normalizeHost().

Here is the call graph for this function:

normalizeHost()

normalizeHost ( $host )

staticprivate

Normalizes a host header/name to a comparable form: lowercased, with any explicit port removed and IPv6 addresses bracketed ([::1]).

Parameters

string

$host

The raw host.

Returns

string The normalized host.

Definition at line 445 of file class.csrf.php.

    {
        $host = strtolower(trim((string)$host));
 
        // Strip a trailing port (both host:port and [ipv6]:port forms)
        if (preg_match('/^\‍[.*\‍]:\d+$/', $host)) {
            $host = substr($host, 0, strrpos($host, ':'));
        } elseif (preg_match('/^[^:]+:\d+$/', $host)) {
            $host = substr($host, 0, strrpos($host, ':'));
        }
 
        // Bracket IPv6 loopback so ::1 and [::1] compare equal
        if ($host === '::1') {
            $host = '[::1]';
        }
 
        return $host;
    }

Referenced by getAllowedHosts(), isAllowedOrigin(), isHostAllowed(), and validateOrigin().

Here is the caller graph for this function:

regenerateToken()

regenerateToken ( )

static

Regenerates the CSRF token. Useful after sensitive operations or login.

Returns

string The new CSRF token

Definition at line 635 of file class.csrf.php.

    {
        self::init();
 
        // Clear all existing tokens
        $_SESSION[self::SESSION_KEY] = [];
 
        // Generate new token
        return self::generateToken();
    }

References generateToken(), and init().

Here is the call graph for this function:

validateOrDie()

validateOrDie ( $removeAfterValidation = false )

static

Validates request and sends JSON error response if validation fails. This is a convenience method for AJAX endpoints.

Parameters

bool

$removeAfterValidation

Whether to remove the token after successful validation

Returns

void Exits with JSON error if validation fails

Definition at line 679 of file class.csrf.php.

    {
        if (!self::validateRequest($removeAfterValidation)) {
            http_response_code(403);
            header('Content-Type: application/json');
            echo json_encode([
                'error'   => 'CSRF validation failed',
                'message' => 'Invalid or expired security token. Please refresh the page and try again.'
            ]);
            exit;
        }
    }

References exit.

validateOrigin()

validateOrigin ( )

staticprivate

Validates that the request is addressed to an intended/trusted host and originates from that same origin.

The request host (HTTP_HOST) must be part of a fixed allowlist of hosts the local server is meant to serve (localhost, 127.0.0.1, ::1, the machine hostname and any configured virtual hosts). Comparing the Origin header against an attacker-influenced HTTP_HOST alone would not stop DNS-rebinding attacks, where a malicious domain is pointed at 127.0.0.1 and both the Host and Origin headers are controlled by the attacker.

Uses the Origin header when present and falls back to the Referer header. Browsers always send Origin on cross-origin POST requests, so a missing Origin/Referer on a state-changing request is treated as invalid.

Returns

bool True if the request is same-origin, false otherwise

Definition at line 266 of file class.csrf.php.

    {
        $httpHost = isset($_SERVER['HTTP_HOST']) ? (string)$_SERVER['HTTP_HOST'] : '';
        if ($httpHost === '') {
            Log::warning('CSRF validation failed: HTTP_HOST not available');
 
            return false;
        }
 
        $allowedHosts = self::getAllowedHosts();
 
        // The request must be addressed to an intended host. This is the key
        // defense against DNS rebinding: an attacker's domain, even resolved
        // to 127.0.0.1, will not be in the allowlist.
        $requestHost = self::normalizeHost($httpHost);
        if (!self::isHostAllowed($requestHost, $allowedHosts)) {
            Log::warning('CSRF validation failed: Request host "' . $requestHost . '" is not an allowed host');
 
            return false;
        }
 
        $scheme = (!empty($_SERVER['HTTPS']) && strtolower((string)$_SERVER['HTTPS']) !== 'off') ? 'https' : 'http';
 
        $origin = isset($_SERVER['HTTP_ORIGIN']) ? (string)$_SERVER['HTTP_ORIGIN'] : '';
        if ($origin !== '') {
            return self::isAllowedOrigin($origin, $httpHost, $scheme, $allowedHosts);
        }
 
        $referer = isset($_SERVER['HTTP_REFERER']) ? (string)$_SERVER['HTTP_REFERER'] : '';
        if ($referer !== '') {
            return self::isAllowedOrigin($referer, $httpHost, $scheme, $allowedHosts);
        }
 
        Log::warning('CSRF validation failed: Missing Origin and Referer headers');
 
        return false;
    }

References getAllowedHosts(), isAllowedOrigin(), normalizeHost(), and Log\warning().

Here is the call graph for this function:

validateRequest()

validateRequest ( $removeAfterValidation = false )

static

Validates a CSRF token from the request (POST body or header). Checks $_POST['csrf_token'] first, then the X-CSRF-Token header. Also verifies the request is same-origin.

Parameters

bool

$removeAfterValidation

Whether to remove the token after successful validation

Returns

bool True if token is valid, false otherwise

Definition at line 218 of file class.csrf.php.

    {
        // Reject cross-origin requests before checking the token.
        // Combined with SameSite=Strict cookies this blocks classic CSRF and
        // DNS-rebinding attacks.
        if (!self::validateOrigin()) {
            return false;
        }
 
        // Accept the token from the POST body or a dedicated header only.
        // Tokens in the query string leak via Referer headers, logs and
        // browser history.
        if (isset($_POST['csrf_token'])) {
            return self::validateToken($_POST['csrf_token'], $removeAfterValidation);
        }
 
        // Check custom header (for AJAX requests)
        $headers = self::getAllHeaders();
 
        // Check for X-CSRF-Token header (case-insensitive)
        foreach ($headers as $key => $value) {
            if (strtolower($key) === 'x-csrf-token') {
                return self::validateToken($value, $removeAfterValidation);
            }
        }
 
        Log::warning('CSRF validation failed: No token in request');
 
        return false;
    }

References getAllHeaders(), validateToken(), and Log\warning().

Here is the call graph for this function:

validateToken()

validateToken ( $token, $removeAfterValidation = false )

static

Validates a CSRF token.

Parameters

string | null	$token	The token to validate
bool	$removeAfterValidation	Whether to remove the token after successful validation (one-time use)

Returns

bool True if token is valid, false otherwise

Definition at line 171 of file class.csrf.php.

    {
        self::init();
 
        // Check if token is provided
        if (empty($token) || !is_string($token)) {
            Log::warning('CSRF validation failed: No token provided');
 
            return false;
        }
 
        // Check if token exists in session
        if (!isset($_SESSION[self::SESSION_KEY][$token])) {
            Log::warning('CSRF validation failed: Token not found in session');
 
            return false;
        }
 
        // Check if token is expired
        $tokenTimestamp = $_SESSION[self::SESSION_KEY][$token];
        if (time() - $tokenTimestamp > self::TOKEN_EXPIRATION) {
            Log::warning('CSRF validation failed: Token expired');
            unset($_SESSION[self::SESSION_KEY][$token]);
 
            return false;
        }
 
        // Token is valid
        Log::debug('CSRF token validated successfully');
 
        // Remove token if one-time use is requested
        if ($removeAfterValidation) {
            unset($_SESSION[self::SESSION_KEY][$token]);
        }
 
        return true;
    }

References Log\debug(), init(), and Log\warning().

Referenced by validateRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

MAX_TOKENS

const MAX_TOKENS = 10

Maximum number of tokens to store per session This prevents session bloat from token accumulation

Definition at line 50 of file class.csrf.php.

SESSION_KEY

const SESSION_KEY = 'bearsampp_csrf_tokens'

Session key for storing CSRF tokens

Definition at line 39 of file class.csrf.php.

TOKEN_EXPIRATION

const TOKEN_EXPIRATION = 7200

Token expiration time in seconds (default: 2 hours)

Definition at line 44 of file class.csrf.php.

---

The documentation for this class was generated from the following file:

• E:/Bearsampp-development/sandbox/core/classes/class.csrf.php