Interview question

How do you prevent CSRF attacks? CSRF attacks को कैसे रोकें?

Answer

CSRF happens when an attacker makes a user unknowingly send requests. Main defense is a CSRF token in forms.

if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF token mismatch');
}

CSRF token को form में embed करें और check करें।

if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF mismatch');
}

Was this answer clear?

Subjects

Related questions