-
-
Notifications
You must be signed in to change notification settings - Fork 18
Expand file tree
/
Copy pathTokenize.php
More file actions
149 lines (123 loc) · 3.28 KB
/
Copy pathTokenize.php
File metadata and controls
149 lines (123 loc) · 3.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
<?php
declare(strict_types=1);
namespace Bow\Security;
use Bow\Session\Exception\SessionException;
use Bow\Session\Session;
use Bow\Support\Str;
class Tokenize
{
/**
* The token expiration time
*
* @static int
*/
private static int $expire_at;
/**
* Get a csrf token generate
*
* @param int|null $time
* @return ?array
* @throws SessionException
*/
public static function csrf(?int $time = null): ?array
{
static::makeCsrfToken($time);
return Session::getInstance()->get('__bow.csrf');
}
/**
* Csrf token creator
*
* @param int|null $time
* @return bool
* @throws SessionException
*/
public static function makeCsrfToken(?int $time = null): bool
{
if (Session::getInstance()->has('__bow.csrf', true)) {
return true;
}
if (is_int($time)) {
static::$expire_at = $time;
}
$token = static::make();
Session::getInstance()->add(
'__bow.csrf',
[
'token' => $token,
'expire_at' => time() + static::$expire_at,
'field' => '<input type="hidden" name="_token" value="' . $token . '"/>'
]
);
Session::getInstance()->add('_token', $token);
return true;
}
/**
* Generate a cryptographically strong token.
*
* Drawn from 32 bytes (256 bits) of CSPRNG output. The previous version
* seeded only 6 random bytes mixed with a time/uniqid/rand() salt, so the
* real entropy floor was ~48 bits and the salt (non-CSPRNG) added none.
*
* @return string
*/
public static function make(): string
{
return Str::slice(hash('sha256', random_bytes(32)), 1, 62);
}
/**
* Check if csrf token is valid
*
* @param string $token
* @param bool $strict
* @return bool
* @throws SessionException
*/
public static function verify(string $token, bool $strict = false): bool
{
if (!Session::getInstance()->has('__bow.csrf')) {
return false;
}
$csrf = Session::getInstance()->get('__bow.csrf');
// Constant-time comparison to avoid leaking the token via timing.
if (!hash_equals((string) $csrf['token'], $token)) {
return false;
}
$status = true;
if ($strict) {
$status = static::CsrfExpired(time());
}
return $status;
}
/**
* Check if the token expires
*
* @param int|null $time
* @return bool
* @throws SessionException
*/
public static function csrfExpired(?int $time = null): bool
{
if (Session::getInstance()->has('__bow.csrf')) {
return false;
}
if ($time === null) {
$time = time();
}
$csrf = Session::getInstance()->get('__bow.csrf');
if ($csrf['expire_at'] >= (int)$time) {
return true;
}
return false;
}
/**
* Destroy the token
*
* @return void
* @throws SessionException
*/
public static function clear(): void
{
Session::getInstance()->remove('__bow.csrf');
Session::getInstance()->remove('_token');
}
}