CSRF Explained - What Is Cross Site Request Forgery - Build Expense Tracker App With PHP 8

[@devnullex]

Yes, yes, yes! This is what I was looking for. Thank you!

[@ProgramWithGio]

👍👍

[@unjoined]

Loved it. I'm yet to start this series but ran into CSRF and you explained it very well! Thank you !

[@ProgramWithGio]

Thank you, welcome to the club 🙌

[@Zubbee]

Hi Gio, thanks for this lesson. Learning about theses security threats and how to deal with them is so valuable. I can't wait to see the XSS lesson. And in all we learn more and more about twig, using middlewares etc. The Guard class... I think this is the first time I am really understanding a vendor's code and how the functions we call from them work. Thanks Gio.

[@ProgramWithGio]

Glad to hear 👍👍

[@walayat_khan]

Thanks and waiting for more security lessons impatiently. Keep it up this great work.

[@ProgramWithGio]

Thank you

[@themaridv2000]

Excellent tutorial as always

[@ProgramWithGio]

Thank you! Cheers 🙌

[@elmarzougui]

Yes Gio you the best and Boss !!!

[@ProgramWithGio]

Thank you 💙

[@sam_sheridan]

Great tutorial buddy 👍

[@ProgramWithGio]

Thank you

[@Netvirux]

I noticed that you demonstrated how to generate and validate CSRF tokens in PHP to protect against CSRF attacks. However, I'm worried that this approach may not be sufficient to prevent attacks if an attacker manages to set a session on their malicious page. If an attacker can trick a user into visiting their malicious page, couldn't they potentially exploit the user's active session to perform unauthorized actions? For example, if the user is logged into a website with an active session and then visits the attacker's page, couldn't the attacker use JavaScript to send requests with the user's session cookies, bypassing the CSRF protection? Thanks!

[@ProgramWithGio]

We have httponly & secure cookies enabled so they shouldn't be able to

[@bijianwu5124]

learnt a lot from you, thanks

[@ProgramWithGio]

Happy to hear that 🙌🙌

[@koomooboo]

What's the best way to centralized csrf tokens in a distributed environment with a load balancer?

[@ProgramWithGio]

Either redis or you could go stateless

[@peterkovacs9086]

Hi, what if create a simple function in Session, (instead of this complicated Slim solution) that will generate long random token(letters-numbers) and passing that token to a hidden input field? And after login compare the Session token and the hidden input value? Becouse i wanna practice without frameworks.

[@ProgramWithGio]

Sure, you can generate token yourself but slim is not complicated, it just has better handling. Also nothing wrong with using frameworks, remember use the right tool for the right job. Don't need to build everything from scratch. For learning purposes sure but for a real site I would advise against building it from scratch. Up to you though

[@yanushevitz5588]

I have a little problem with persisting token in storage propably. After generating, token is saved in session indeed and I've checked it, but when it comes to validate that token, I always get failed CSRF check and after checking session in moment of validation, there is only "csrf" key in array, but no data in it. Could it be session's fault? Even after changing branch to P10_End or P10_Start and following your steps, nothing changes. I feel like it's my job to find answer but I'm stuck a bit needing little guide. Thanks a lot for another great video and for sharing with people your knowledge 🙌

[@ProgramWithGio]

Please share your code on GitHub and I can take a look. Maybe middleware is missing or not applied correctly

[@yanushevitz5588]

@@ProgramWithGio I found out!!!!!! It's my enviromental issues because I keep all my projects on server which doesn't have SSL enabled, and therefore it denies to create cookie, because without HTTPS you can't enable "secure" option. It was unable to store in session because I didn't have any session started. I always forget to check console logs 😅And also that's the reason why even switching branches to your official ones didn't make any changes for me

[@ProgramWithGio]

@@yanushevitz5588 glad you figured it out, good job 👏

[@hansschuijff]

Create lesson again, Gio. Thanks. Is is necessary to still pass the token key/value pair to the template, when you generate and pass the input fields too? We don't seem to use those global values anymore at this point. Why not use a view to generate only those two inputs, so the html is all kept in views and in one spot? Can a mallicious script get access to the hidden fields and still break this token system? It still seems fragile having to add the token to the html, like adding a password openly in the html. We can even use inspector to access it. The cooky options will prevent a cookie from being accessed, but html would still be accessible. That part doesn't seem so secure. Am I missing something?

[@ProgramWithGio]

Not necessary but I keep it there in case we want to access token values directly. I prefer {{ }} syntax to render fields as oppose to {% include ... %}. Feel free to use include instead & a view file, it should still work. About token being visible in inspect element yes that's fine, how would hacker gain access to it? If hacker has access to the user's browser like physical computer then they can just do whatever they want, they don't need token. Those tokens also get regenerated on page load so they don't live that long and therefore stealing that token won't do any good since on next page load it would be invalid

[@Zubbee]

@@ProgramWithGio I was thinking about this visibility too but your explanation makes a whole lot of sense. I understand why there isn't much need to abstract it further

[@hansschuijff]

@@ProgramWithGio Thank you, I understand.

[@ahmededris2536]

شكرا 💙💙

[@ProgramWithGio]

🙌🙌

[@Zubbee]

Great. Like clockwork. Let me wear my gloves 😜

[@ProgramWithGio]

Always 🙌

[@toogoodtogo9060]

Thanks for the in-depth video. However, it was almost painful to watch you inlining the HTML inputs at the end. Since you already have the magic of Twig at hands, I'd recommend to simply use the Twig include tag with a another file where you put the two HTML tags in. Way cleaner! 😉

[@ProgramWithGio]

Thank you. I thought about that but I personally prefer {{ csrf.fields | raw }} vs using include. I don't like mixing html in app layer either and almost never do, but in this case I don't think is a big deal, it's a sacrifice I'm willing to make for convenience, maybe I'll change it later, we'll see. If I had enough time I would create a HTML generator or builder class that sort of builds the input fields & has the toString magic method to render it.

[@vladoks7965]

Is this application in Laravel framework or raw PHP?

[@ProgramWithGio]

It's Slim & vanilla PHP, check the lesson P.0 for the overview

[@vladoks7965]

@@ProgramWithGio Thx for answer. I see that Slim framework is very similar with Laravel or i'm wrong...

[@ProgramWithGio]

@@vladoks7965 Not really, slim has very minimal features, just http layer I would say like routing & middleware. Rest we build on top of it, it may look like Laravel structure because we are sort of building it out that way.

[@vladoks7965]

@@ProgramWithGio Thx a lot, you are the best💪

[@phpisdead]

When will we start laravel series?

[@ProgramWithGio]

I don't have a set date, so can't tell you when

Can we have a mezzio serries please??? 🤓

[@ProgramWithGio]

I don't use it so can't promise series on it. Maybe in future, but for now I have a lot of content in queue that I need to work on :)

@@ProgramWithGio Okay, gotcha! Hopefully in the future then. Thanks for all the videos you've uploaded, they are very straightforward and easy to follow.