Phosphorum\Utils\Security::getPrefixedTokenKey PHP Метод

getPrefixedTokenKey() публичный Метод

Generates a pseudo random token key to be used as input's name in a CSRF check.
public getPrefixedTokenKey ( string $prefix ) : string
$prefix string
Результат string
    public function getPrefixedTokenKey($prefix)
    {
        $key = $prefix . ':' . $this->_tokenKeySessionID;
        if (!isset($this->prefixedTokenKeys[$key])) {
            $tokenKey = $this->_random->base64Safe($this->_numberBytes);
            $this->prefixedTokenKeys[$key] = $tokenKey;
            /** @var \Phalcon\Session\AdapterInterface $session */
            $session = $this->getDI()->getShared('session');
            $session->set($key, $tokenKey);
        }
        return $this->prefixedTokenKeys[$key];
    }

Usage Example

Пример #1
0
 /**
  * Tests Security::checkPrefixedToken method
  */
 public function testCheckPrefixedToken()
 {
     $this->specify('The Security::checkPrefixedToken works incorrectly', function () {
         $di = $this->setupDI();
         $s = new Security();
         $s->setDI($di);
         // Random token and token key check
         $tokenKey = $s->getPrefixedTokenKey('y');
         $token = $s->getPrefixedToken('y');
         $_POST = [$tokenKey => $token];
         expect($s->checkPrefixedToken('y', null, null, false))->true();
         expect($s->checkPrefixedToken('y'))->true();
         expect($s->checkPrefixedToken('y'))->false();
         // Destroy token check
         $tokenKey = $s->getPrefixedToken('z');
         $token = $s->getPrefixedToken('z');
         $s->destroyPrefixedToken('z');
         $_POST = [$tokenKey => $token];
         expect($s->checkPrefixedToken('z'))->false();
         // Custom token key check
         $token = $s->getPrefixedToken('abc');
         $_POST = ['custom_key' => $token];
         expect($s->checkPrefixedToken('abc', null, null, false))->false();
         expect($s->checkPrefixedToken('abc', 'other_custom_key', null, false))->false();
         expect($s->checkPrefixedToken('abc', 'custom_key'))->true();
         // Custom token value check
         $token = $s->getPrefixedToken('xyz');
         $_POST = [];
         expect($s->checkPrefixedToken('xyz', null, null, false))->false();
         expect($s->checkPrefixedToken('xyz', 'some_random_key', 'some_random_value', false))->false();
         expect($s->checkPrefixedToken('xyz', 'custom_key', $token))->true();
     });
 }