Securing user input through forms PHP

Question

I am making my own social media network for a project at college. One hurdle I have come across is secure forms.

I am making an option for one user to send a friend request to another user, which I can code. But that tricky part is making it secure. If I were to just use xxxxxx/profile.php?id=2&action=sendfr then people could be sent that link and made to send them a friend request.

If I sent action=sendfr as POST data then a spoofer could make a form on a website to do the same.

One method I am considering is sending some sort of AuthKey in POST data that is sent to the client for these purposes.

Could anyone please recommend the best option for making user actions secure?

The only cookie I use is PHPSESSID, My consideration is when the page loads having a token sent to the user via javascript variable that can be used in POST forms to authenticate actions. — Morgan Stephen
– Morgan Stephen, Commented Oct 28, 2017 at 1:13

Tae · Accepted Answer · 2017-10-28 01:23:18Z

2

What you are trying to avoid is a Cross-site request forgery. There several ways to avoid them but the most popular is to generate a random token in the server and send it with every page that can make changes in persistent data. Then when the user sends a request back it must include the token so the server can verify that the tokens match. In this case the tokens must be random and different in every request. You would find more details and techniques in the OWASP page linked above.

answered Oct 28, 2017 at 1:23

Tae

1,6956 gold badges25 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Morgan Stephen Over a year ago

I have just make it so when a session starts (user logs in); for that php session the user is given a token that is stored in $_SESSION. This token is echoed into forms which relay it back to the server via POST.

Tae Over a year ago

As long as your CSRF token is not the same as the session token you should be OK

Collectives™ on Stack Overflow

Securing user input through forms PHP

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related