Provides CSRF protection & validation.
This middleware adds a CSRF token to a cookie. The cookie value is compared to request data, or the X-CSRF-Token header on each PATCH, POST, PUT, or DELETE request.
If the request data is missing or does not match the cookie data, an InvalidCsrfTokenException will be raised.
This middleware integrates with the FormHelper automatically and when
used together your forms will have CSRF tokens automatically added
when $this->Form->create(...) is used in a view.
$_defaultConfig : array
Default config for the CSRF handling.
cookieName The name of the cookie to send.
expiry A strotime compatible value of how long the CSRF token should last.
Defaults to browser session.secure Whether or not the cookie will be set with the Secure flag. Defaults to false.httpOnly Whether or not the cookie will be set with the HttpOnly flag. Defaults to false.field The form field to check. Changing this will also require configuring
FormHelper.__invoke(\Cake\Http\ServerRequest $request, \Cake\Http\Response $response, callable $next) : \Cake\Http\Response
Checks and sets the CSRF token depending on the HTTP verb.
| \Cake\Http\ServerRequest | $request | The request. |
| \Cake\Http\Response | $response | The response. |
| callable | $next | Callback to invoke the next middleware. |
A response
_validateAndUnsetTokenField(\Cake\Http\ServerRequest $request) : \Cake\Http\ServerRequest
Checks if the request is POST, PUT, DELETE or PATCH and validates the CSRF token
| \Cake\Http\ServerRequest | $request | The request object. |
_addTokenToRequest(string $token, \Cake\Http\ServerRequest $request) : \Cake\Http\ServerRequest
Add a CSRF token to the request parameters.
| string | $token | The token to add. |
| \Cake\Http\ServerRequest | $request | The request to augment |
Modified request
_addTokenCookie(string $token, \Cake\Http\ServerRequest $request, \Cake\Http\Response $response) : \Cake\Http\Response
Add a CSRF token to the response cookies.
| string | $token | The token to add. |
| \Cake\Http\ServerRequest | $request | The request to validate against. |
| \Cake\Http\Response | $response | The response. |
$response Modified response.
_validateToken(\Cake\Http\ServerRequest $request) : void
Validate the request data against the cookie token.
| \Cake\Http\ServerRequest | $request | The request to validate against. |
When the CSRF token is invalid or missing.