Our focus for this session is the cross-site request forgery.
This is a kind of malicious attack that the malicious user can perform to trick you into sending a form,
and you might not even be aware of that.
Now, I think that a real example can explain it much better than words.
So I've made a malicious website that is not really looking like anything malicious at all, and I'm
just going to show it to you.
I also included under this video code, so you can just download it and run it yourself and see how
it works.
Now let's get to it.
So this is this file CSRF attack.
Also make sure that you have our current app running.
Let me open it.
Is there anything suspicious at all here?
Does it look like beautiful kitten, though.
It is.
What happened?
This is our page and form was submitted and suddenly it says that hacked user.
Thanks for your message.
And that's the message that was sent.
This message was submitted via CSRF attack.
So this is a real thing.
If your forms are not protected from the CSRF attacks, this can happen.
Now to put it in perspective, if someone adds a message to our guestbook, maybe that's not the end
of the world, but users can be easily tricked to send forms that might be much more dangerous.
So if you imagine someone is signed in and maybe makes a bank transfer or needs to change a password
if those forms are not protected from the CSRF attack, the malicious user can do much more damage than
just adding an entry to a guestbook.
That's why we need to protect our applications from the CSRF attack.
And we're going to learn how.
So let's increase the coding space and let me jump to the contact post route.
As you see we've got a placeholder for the CSRF token validation here.
So let's begin by adding some logic for the CSF validation.
We're going to do it step by step.
And the first thing that we are going to do is to block of the form sending.
If we don't have a valid token which might disable the form for a bit.
At least we would be protected.
Let me create the CSV file inside includes and start with a PHP tag.
Then not to forget to do it later.
In the bootstrap.
Let's include this file.
Okay, we can close the bootstrap file and let me add a function.
This would be validate CSRF token.
And it accepts a string which can be null because by default the token would be null unless we generate
it.
And for now let's just return false from it.
We're going to implement this obviously later on.
For now it returns false.
Now inside our router let's remove this comment.
And the first thing I'd like to do here is to validate the token.
So we're going to check if the validate CSRF token that is coming from the post data.
So it will be sent together with the form.
And if the CSRF token field.
Let's also provide a default if it doesn't exist.
So if we can't validate it, we're just going to add a flash message saying that's an error.
And we're going to say sorry.
Please send the form again without any specific details.
And we're just going to redirect to the contact form again.
So we begin with the CSRF protection.
And if I now jump to the contact form and I'm actually sending it from our website and providing some
valid data, the form is logged.
Also this malicious user from this kitten website Can't send the phone.
Now our job is to first generate this token, store it someplace, and we're going to store it in a
session because this is a per user thing.
Every user would have the token automatically generated unique to that user.
That's why it is stored in the user's session.
And then this token will have some lifetime let's say 30 minutes.
And that's the time that users have to submit this form.
If they wouldn't do it in 30 minutes, well basically the form submission will fail.
So now I'd like to dissect this topic of CSRF protection step by step.
I think we will conclude by now, and in the next video we are actually going to generate those tokens.
So we have something to validate.