[PHP] CSRF Protection

[jur13n]

PHP CSRF Protection.

Add this token (stored in the session) to each form and validate on each POST.

<?php

class HazeCSRF
{
	public static function setCSRFToken()
	{
		$session_id = session_id();
		$user_ip = $_SERVER['REMOTE_ADDR'];
		$time = time();

		$token = HazeHash::create($session_id.$user_ip.$time);

		HazeRequest::setSession('csrf_token', $token);
	}

	public static function encryptCSRFToken($method = "AES-256-CBC")
	{
		$advanced = HazeConfig::get('Advanced');
		$secret = $advanced['encrypt_salt'];

		if(!HazeRequest::getSession('csrf_token'))
		{
			self::setCSRFToken();
		}

		$iv_size = mcrypt_get_iv_size(MCRYPT_CAST_256, MCRYPT_MODE_CBC);
		$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);

		$encrypted = openssl_encrypt(HazeRequest::getSession('csrf_token'), $method, $secret, 0, $iv);
		return base64_encode($iv.$encrypted);
	}

	public static function decryptCSRFToken($token, $method = "AES-256-CBC")
	{
		$advanced = HazeConfig::get('Advanced');
		$secret = $advanced['encrypt_salt'];

		$token = base64_decode($token);
		
		$iv_size = mcrypt_get_iv_size(MCRYPT_CAST_256, MCRYPT_MODE_CBC);
		$iv = substr($token, 0, $iv_size);

		return openssl_decrypt(substr($token, $iv_size), $method, $secret, 0, $iv);
	}

	public static function isValid($csrf_token)
	{
		$token = self::decryptCSRFToken($csrf_token);

		if($token == HazeRequest::getSession('csrf_token'))
		{
			self::setCSRFToken();
			return true;
		}

		return false;
	}
}

I'll just leave it here.
Good luck.