VerifyCsrfToken.php

Go to the documentation of this file.

<?php
 
namespace Ubiquity\utils\http\session\protection;
 
use Ubiquity\utils\http\session\AbstractSession;
use Ubiquity\utils\http\UCookie;
use Ubiquity\log\Logger;
 
class VerifyCsrfToken implements VerifySessionCsrfInterface {
    private AbstractSession $sessionInstance;
    private const TOKEN_KEY = 'X-XSRF-TOKEN';
 
    public function __construct(AbstractSession $sessionInstance) {
        $this->sessionInstance = $sessionInstance;
    }
 
    protected function csrfErrorLog() {
        $context = [];
        $context ['HOST'] = $_SERVER ['HTTP_HOST'];
        $context ['REQUEST_URI'] = $_SERVER ['REQUEST_URI'];
        $context ['REQUEST_METHOD'] = $_SERVER ['REQUEST_METHOD'];
        $context ['cookie'] = $_COOKIE;
        Logger::error ( 'Session', 'CSRF protector validation failure!', 'startSession', $context );
    }
 
    public function init(): void {
        $token = new CsrfToken ();
        $this->sessionInstance->set ( self::TOKEN_KEY, $token );
        UCookie::set ( $token->getName (), $token->getValue (), null );
    }
 
    public function clear(): void {
        $token = $this->sessionInstance->get ( self::TOKEN_KEY );
        $this->sessionInstance->delete ( self::TOKEN_KEY );
        if (isset ( $token )) {
            UCookie::delete ( $token->getName () );
        }
    }
 
    public function start(): void {
        $token = $this->sessionInstance->get ( self::TOKEN_KEY );
        if (isset ( $token )) {
            if (! $token instanceof CsrfToken || ! hash_equals ( $token->getValue (), '' . UCookie::get ( $token->getName () ) )) {
                if (Logger::isActive ()) {
                    $this->csrfErrorLog ();
                }
                $this->clear();
                $this->sessionInstance->terminate ();
            }
            return;
        }
        $this->init ();
    }
 
    public static function getLevel(): int {
        return 1;
    }
}