The last time we have converted our old CSRF token code from the function base code into a class based
code, improving bits here and there.
I think it would be a little bit easier to use, so we don't really need this old project code anymore.
I'm just going to switch to a full screen view with a browser preview, and I'd like us to just apply
this CSRF protection inside.
Probably the only form we have so far, but we just need to see if everything works fine.
Also, since we have this utilities file, we can also come up with an easier way to render or add the
CSRF token to a form.
So let's switch to a different view right now.
Okay guys.
So we are in a different view.
Next up we should jump to the helpers file.
This is where we create functions that can be easily used inside the views inside templates.
So again let's check if specific function exists.
I'm going to call this one CSRF token.
It's just supposed to be rendering the CSRF token in a form.
Let me define it then that function.
CSRF token.
Don't think it requires any parameters and it should return a string.
Now, since we actually depend on the token having a specific name, we literally check if the field
name is underscore token.
I think this helper should not only give you a value of the current token inside templates.
I've misspelled this again.
It instead should just return the whole input tag.
So by using this function, you should just make sure you've got the input with the correct value.
You shouldn't really worry about anything else.
So I think we can use the here doc syntax for this.
So let me return those three characters and the custom string.
That's a valid here doc.
And now I'm adding the input of type hidden the name of it.
Well we would need to use the CSRF class which has this as a const.
Token field name.
And the value.
This would be.
CSV.
Get token if I'm right.
Generate token.
Get token.
Okay.
Um, so that's the method that will give you, well, the most up to date token.
We should also rethink what this publicly available because I don't think this method should be public.
We should only have one way of accessing the token.
And this should be this generate token method.
Uh, sorry.
This should be get token method.
And this one should just be used internally.
All right.
So I think it's fine.
Let's just make sure we have this class used.
It's up services CSV or you know what I think maybe let's go with uppercase.
Name.
And let me just rename the file to be extra.
Sure.
It just looks better.
So let's go with that.
And this is uppercase CSV since the case matters.
That's why you need to do it this way.
Okay.
So now to just output the or to have this token inside a form, we can just call this function which
just should be globally available.
So let me jump to our I think only form where we have this CSV placeholder.
So now it is as simple as doing CSRF token.
And that's it.
So let's jump to the form.
And now the thing is that generating the token without validating it would not do us any good.
That's why we need to make sure in every action that is handling the form submission, that we verify
the token, and that it is the first thing that we do.
That's why we've got this todo item in here.
Now let me mention this again that I think that the token verification should be automatic.
We should always automatically verify tokens on all the requests that are of specific type like post,
put, delete, etc. we're going to do it later on very soon, but we would need to learn a couple more
more concepts before we can do that.
For now, let's just verify the token manually.
So this would be if CSRF verify.
And in this case, I'm not gonna be passing the token because I just want it automatically taken from
the form.
So if the verification fails.
I think we need.
Okay, so this is nullable without nullable default values.
So we need to change that.
To be null by default.
Okay I think this should be fine.
Okay.
Now if this fails let's think what we can do.
What options do we have.
We should tell someone about it.
Or we should display an error page.
Now there is actually a pretty good candidate for an error code.
That's for 19 page expired.
Now you for sure gonna see this error when working with the Laravel PHP framework, and it is often
just displayed on this very issue when you have an expired CSRF token.
So after all the work that we did with CSRF tokens, now you're gonna deeply understand why does it
happen?
Is this docs or this page of I've just found is even mentioning Laravel PHP framework right here.
And I think that we should just create the same error.
So let's make a view for it.
This is for 19 PHP.
And we just gonna display an specific view for this error.
Let's say it's for 19.
It's often called session expired.
We can call it page expired.
And I'm going to say you probably took too long to submit a form.
Sorry.
And please try again.
Be quicker.
Maybe that's not a very funny joke, but, um, at least we tell people what's happening.
And let's close this.
And we can either choose to render it right away or use router to just redirect to those errors.
Let's see if we have photo for method inside this.
Yeah we've got 404 which is not found.
Why don't we add page expired returning the right code which is 419 and redirecting or just rendering
the view straight away and doing an exit.
And here we can just use router page expired.
And I think it's perfect.
Super simple.
Easy to understand.
We fade the verifications of the page is expired and we know what's happening.
And even though this is super simple, I still think this should be automated.
So whenever there is a Post request, we should just automatically do it without having to remember
about that.
And I think that's it.
We can now finally test this.
So for testing I think we should make a shorter token.
It's in seconds.
So first let's see if the token would be expired.
Now let me refresh the form first and see if we even render the token.
It seems that we are not properly rendering it as you see right here.
It is treating the code literally.
So let's fix this first.
I think we can just, um, get the token field name first into a variable.
So this is not accessible.
Probably it is just private.
Okay.
We need to change that to public.
Let's go back to helpers.
Now we should get the token field name.
There it is.
Let me replace that with token field.
And the next thing is the token itself.
Let's get it.
Get token.
And let's just put a variable here without any curly braces.
Now, after refreshing the form, we can see the name and the value seems more correct.
Let me make it a little bit smaller.
Okay, so it's five seconds.
So I should just not make it.
I typed a form and I think that five seconds have already passed and the page is expired, which is
what we actually expect.
That should be the error that is being displayed.
Now let's change that back to 30 minutes.
And this time I think I should be able to do it.
So we've got a new token that is a little longer, and I was able to do it in time and also to verify
and confirm the token, which also confirms that this feature works fine.