PHP防止伪造跨站请求:表单中插入隐藏的随机串

69 篇文章 0 订阅


随机串代码实现

创建一个crumb的实现,代码如下:

 <?php
class Crumb {                                                                                                 
                                                                                                                 
    CONST SALT = "your-secret-salt";                                                        
                                                                
    static $ttl = 7200;                                                                                          
                                                                                                                 
    static public function challenge($data) {                                                                    
        return hash_hmac('md5', $data, self::SALT);                                                              
    }                                                                                                            
                                                                                                                 
    static public function issueCrumb($uid, $action = -1) {                                                      
        $i = ceil(time() / self::$ttl);                                                                          
        return substr(self::challenge($i . $action . $uid), -12, 10);                                            
    }                                                                                                            
                                                                                                                 
    static public function verifyCrumb($uid, $crumb, $action = -1) {                                             
        $i = ceil(time() / self::$ttl);                                                                          
                                                                                                                 
        if(substr(self::challenge($i . $action . $uid), -12, 10) == $crumb ||                                    
            substr(self::challenge(($i - 1) . $action . $uid), -12, 10) == $crumb)                               
            return true;                                                                                         
                                                                                                                 
        return false;                                                                                            
    }                                                                                                            
                                                                                                                 
}

 

代码中的$uid表示用户唯一标识,而$ttl表示这个随机串的有效时间。

应用示例

构造表单
在表单中插入一个隐藏的随机串crumb

<form method="post" action="demo.php">
<input type="hidden" name="crumb" value="<?php echo Crumb::issueCrumb($uid)?>">
<input type="text" name="content">
<input type="submit">
</form>

处理表单 demo.php
对crumb进行检查

<?php
if(Crumb::verifyCrumb($uid, $_POST['crumb'])) {
    //按照正常流程处理表单
} else {
    //crumb校验失败,错误提示流程
}
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值