Preventing Hustening Exit from Unreliable Sources in PHP

Question

I have an action on my site:

http://mysite.com/User/Logout

This will cause the current user to log out of his session. Since this is a simple GET request, an attacker can either create links to this page, or even put this link in the image attribute src, which will force users to log out. Anyway, I would like to keep the exit link simple without going too far, but at the same time I would like to be able to prevent the scenario described above.

Any ideas?

Answer 1

, , CSRF:

• . , "", ,

  <form action="/User/logout" method="post">
      <submit name="logout" value="Logout" />
      <input type="hidden" name="token" value="<?php echo getSessionToken(); ?>" />
  </form>
  

  , POST , GET .

  php :

  if (getSessionToken(true) != $_POST['token']) {
      die('CSRF!');
  }
  

  , getSessionToken :

  function getSessionToken($reset = false) {
      if (!isset($_SESSION['random_token'])) {
          $_SESSION['random_token'] = sha1(uniqid(mt_rand(), true));
      }
      $token = $_SESSION['random_token'];
      if ($reset) {
          unset($_SESSION['random_token']);
      }
      return $token;
  }
  

  , , , , reset - ( ). , .

• , . , , , - . , . , :

  <a href="/User/logout?token=<?php echo getSessionToken(); ?>">Logout</a>
  

  , . - .

OWASP CSRF Guidelines CSRF. , , ...

Answer 2

GET ( - , GET, ), . POST . GET , . RFC 2616 9.1.

, GET RFC, , , XSRF. . ircmaxell .

Answer 3

HTTP . , . !

Answer 4

/ ? # NONCE #, # NONCE # - , .

Answer 5

, - . , . , ..... , .

, cookie , http only cookie - PHP ( javascript cookie).

<?php
   session_start();
   if ($_GET['logout_valid']!==session_id()) {
       // handle invalid logout request
       exit;
   } else {
       $_SESSION=array();
       session_destroy();
   }

Answer 6

, , :

<?php

session_start();

function logoutButton($name = 'logout', $action = '/User/logout'){
$random_token = md5(uniq_id());
$_SESSION['csrf'] = $random_token;
$form = '<form ><input type="hidden" value="'. $random_token .'" name="' .$name. '"><input type="button" value="logout"><</form>';
return $form;
}

public static isValidRequest($name = 'logout'){
if(isset($_POST[$name]) && $_POST[$name] === $_SESSION['csrf']){
    return true;
}
return false;
}

}
?>

echo logoutButton();

if(isValidRequest()){
    //logout
}

Hope this is helpful to someone.

edit: Here is the class I created https://github.com/sahithvibudhi/PHP-CSRF-Protection-class