SproutCMS

class Csrf

Protection against Cross Site Request Forgery (CSRF) attacks

• File: /sprout/Helpers/Csrf.php
• Namespace: Sprout\Helpers

Functions

public check

Gets the CSRF token in the postdata.
Checks that it is valid.
Returns TRUE on success and FALSE on failure

public checkOrDie

Checks the CSRF token
If it fails, redirect the user to the home page, and report an error

public getTokenValue

Fetches the secret token value

This is intended for use on JavaScript requests that require CSRF protection.
Note that it is important that this value isn't placed in GET parameters, as this
may result in the value being leaked through logging or other methods.

protected initialiseSession

Initialises the PHP session and, if not present, generates a CSRF secret for the session

public token

Generates a CSRF hidden form field