8000 generateCsrfToken · Issue #9300 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

generateCsrfToken #9300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
t3chn0r opened this issue Oct 15, 2013 · 4 comments
Closed

generateCsrfToken #9300

t3chn0r opened this issue Oct 15, 2013 · 4 comments

Comments

@t3chn0r
Copy link
Contributor
t3chn0r commented Oct 15, 2013

II'm not sure if I understand what generateCsrfToken() is supposed to do so bare with me for a second. My understanding is that generateCsrfToken() generates a random string of characters/numbers based on an "intention" that is passed to it. Now, my understanding is that this random set of characters/numbers changes every time I call the function even with the same intention string... Is this wrong?

I just created a simple controller action that generates the CSRF with the same intention 5 times but the CSRF generated is alway the same:

/**
     * @Route("/csrf", name="_le_test_csrf")
     */
    public function csrfAction()
    {
        $csrfs = $this->container->get('form.csrf_provider')->generateCsrfToken('test').'<br>';
        $csrfs .= $this->container->get('form.csrf_provider')->generateCsrfToken('test').'<br>';
        $csrfs .= $this->container->get('form.csrf_provider')->generateCsrfToken('test').'<br>';
        $csrfs .= $this->container->get('form.csrf_provider')->generateCsrfToken('test').'<br>';
        $csrfs .= $this->container->get('form.csrf_provider')->generateCsrfToken('test').'<br>';

        return new Response($csrfs);
    }

6af5e27e57cde92e85fdd80d6ace6ad8ba241aa9
6af5e27e57cde92e85fdd80d6ace6ad8ba241aa9
6af5e27e57cde92e85fdd80d6ace6ad8ba241aa9
6af5e27e57cde92e85fdd80d6ace6ad8ba241aa9
6af5e27e57cde92e85fdd80d6ace6ad8ba241aa9

Every single form in my application is submitted via Ajax and I'm trying to change and update the CSRF field in the form on each submission to make sure the same CSRF is not used twice but I found out that I can't generate a new CSRF token with the same intention.

Any help will be appreciated.

Regards
@stof
Copy link
Member
stof commented Oct 16, 2013

In Symfony 2.3 and below, there is no way to make a CSRF token expire (except expiring the whole session as the token depends on the session id). It is not different on each generation, otherwise you would not be able to check it (checking it is implemented by generating it again and comparing the value).

The implementation has changed in 2.4 (currently in beta) to allow expiring CSRF token (the intention is now used to store the token in the session, not to generate the token).

@t3chn0r
Copy link
Contributor Author
t3chn0r commented Oct 16, 2013

Thanks @stof, do you know if this new implementation will make its way to 2.3 being the LTS version? Maybe it can be classified as a "security enhancement"?

Thanks a lot again for your quick response and help!

Regards

@stof
Copy link
Member
stof commented Oct 16, 2013

No it cannot. It is a new feature as it is a whole new implementation (added in the security component instead of the form component). New features are never backported to maintenance releases

@t3chn0r
Copy link
Contributor Author
t3chn0r commented Oct 16, 2013

No problem, I guess I'll move to 2.4 then once it's released. Thanks!

@Tobion Tobion closed this as completed Oct 16, 2013
fabpot added a commit that referenced this issue Feb 20, 2018
@fabpot
feature #26175 [Security] Add configuration for Argon2i encryption (C…
2711d14 
…oalaJoe)

This PR was merged into the 4.1-dev branch.

Discussion
----------

[Security] Add configuration for Argon2i encryption

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #26174
| License       | MIT
| Doc PR        | [#9300](symfony/symfony-docs#9300)

Feedback?

Current situation: Configuration only applies if argon2i is natively supported.

Commits
-------

1300fec [Security] Add configuration for Argon2i encryption
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@stof @Tobion @t3chn0r
0