CSRF Protection

Introduction

Protection against CSRF (Cross-Site Request Forgery) attacks is essential for securing your web applications. BowPHP provides simple and effective tools to prevent these attacks by automatically generating and validating CSRF tokens.

What is a CSRF attack?

A CSRF attack consists of tricking an authenticated user into performing an unauthorized action on an application. To prevent this, Bow generates a unique CSRF token for each active user session. This token is used to validate every request sent to the application.

CSRF Protection

To protect your forms, include a hidden field containing the CSRF token:

<form method="POST" action="/upload">
  {{{ csrf_field() }}}
  ...
</form>

The Bow\Middleware\CsrfMiddleware::class middleware, included in the default web middleware group, automatically verifies that the provided token matches the one stored in the session.

Configuration

You can enable or disable automatic verification in the config/app.php file, using the auto_csrf key:

return [
  ...
  "auto_csrf" => true,
  ...
];

tip

CSRF verification is enabled by default (true). It is recommended to never disable it in production.

Integration with JavaScript

When building applications that use AJAX or JavaScript libraries such as Axios or jQuery, it is recommended to configure your HTTP library to automatically include the CSRF token in the request headers.

Step 1: Add the CSRF token in a META tag

Add the CSRF token to an HTML META tag:

<meta name="csrf-token" content="{{ csrf_token() }}">

Step 2: Configure your JavaScript library

Next, configure your library to include this header in every request:

Example with jQuery

$.ajaxSetup({
  headers: {
    'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
  }
});

Example with Axios

import axios from 'axios';

axios.defaults.headers.common['X-CSRF-TOKEN'] = document.querySelector('meta[name="csrf-token"]').getAttribute('content');

Managing CSRF Tokens

Tokens in HTTP headers

In addition to form fields, Bow allows you to use the X-CSRF-TOKEN header to validate requests. This is particularly useful for AJAX requests.

Tokens in cookies

Bow also generates a cookie named XSRF-TOKEN containing the current CSRF token. This cookie can be used to automatically configure the X-XSRF-TOKEN header.

For example, frameworks such as Angular and Axios use this cookie to secure requests without additional configuration.

Conclusion

With BowPHP, implementing CSRF protection becomes simple and effective, allowing you to focus on developing features while ensuring the security of your users.

Best practices

• Always enable CSRF protection in production
• Use csrf_field() in all your POST/PUT/DELETE forms
• Properly configure CSRF headers for AJAX requests
• Never disable CSRF verification except for specific API endpoints that are otherwise secured

Is something missing?

If you run into problems with the documentation or have suggestions to improve the documentation or the project in general, please open an issue for us, or send a tweet mentioning the Twitter account @bowframework or directly on github.