php - CSRF 방지

editor.php

<?php
$_SESSION['token'] = md5(uniqid(mt_rand(), true));
?>

<input type="hidden" name="token" value="<?php echo $_SESSION['token'] ?? '' ?>">

 

posting.php

<?php

$token = filter_input(INPUT_POST, 'token', FILTER_SANITIZE_STRING);

if (!$token || $token !== $_SESSION['token']) {
    // return 405 http status code
    header($_SERVER['SERVER_PROTOCOL'] . ' 405 Method Not Allowed');
    exit;
} else {
    // process the form
}

 

 

출처: 

https://www.phptutorial.net/php-tutorial/php-csrf/

PHP CSRF

 

https://wonpaper.tistory.com/417

[PHP] CSRF 공격방어 작업하기