CSRF Protection and Secure Forms

Cross-site request forgery tricks a logged-in user's browser into submitting a request to your site. Defend with synchronizer tokens (random per-session token in a hidden field, validated with hash_equals()), SameSite cookies, and by never changing state on GET. Frameworks (Symfony, Laravel) include CSRF middleware — keep it enabled for cookie-authenticated routes.

<?php
function csrfToken(): string
{
    return $_SESSION['csrf'] ??= bin2hex(random_bytes(32));
}

function verifyCsrf(): void
{
    $sent = $_POST['_csrf'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
    if (!is_string($sent) || !hash_equals($_SESSION['csrf'] ?? '', $sent)) {
        http_response_code(419);
        exit('Invalid CSRF token');
    }
}
?>
<form method="post" action="/account/email">
  <input type="hidden" name="_csrf" value="<?= e(csrfToken()) ?>">
  <input type="email" name="email" required>
  <button>Update</button>
</form>

Common pitfalls

• Changing state via GET links (e.g., /delete?id=5).
• Comparing tokens with == instead of hash_equals().
• Disabling CSRF middleware for convenience on session-authenticated APIs.

Key points

• Random tokens validated with hash_equals
• SameSite=Lax cookies
• No state changes on GET

Further reading: OWASP CSRF Prevention Cheat Sheet