SessionCSRF class
Provides an API for cross site request forgery protection.
// output somewhere in form markup when rendering a form
echo $session->CSRF->renderInput();// when processing form (POST request), check to see if token is present
if($session->CSRF->hasValidToken()) {
// form submission is valid
// okay to process
} else {
// form submission is NOT valid
throw new WireException('CSRF check failed!');
}// this alternative to hasValidToken() throws WireCSRFException when invalid
$session->CSRF->validate(); Click any linked item for full usage details and examples. Hookable methods are indicated with the icon. In addition to those shown below, the Session class also inherits all the methods and properties of: Wire.
Initiating
| Name | Return | Summary | |
|---|---|---|---|
Session Session Session | array | Get a CSRF Token name and value that can only be used once | |
Session Session Session | array | Get a CSRF Token name and value | |
Session Session Session | string | Get a CSRF Token name, or create one if it doesn't yet exist | |
Session Session Session | int | Get a CSRF Token timestamp | |
Session Session Session | string | Get a CSRF Token value as stored in the session, or create one if it doesn't yet exist | |
Session Session Session | string | Render a form input[hidden] containing the token name and value, as looked for by hasValidToken() |
Validating
| Name | Return | Summary | |
|---|---|---|---|
Session Session Session | bool | Returns true if the current POST request contains a valid CSRF token, false if not | |
Session Session Session | bool | Throws an exception if the token is invalid |
Resetting
| Name | Return | Summary | |
|---|---|---|---|
Session Session Session | None | Clear out all saved token values | |
Session Session Session | None | Clear out token value |
Additional methods and properties
In addition to the methods and properties above, Session
API reference based on ProcessWire core version 3.0.252