将令牌方法添加到Yii内的登录表单

Question

So i am trying to add the token method as an extra security feature in the login and what i did is the following

login.php

$token = $_SESSION['token'] = md5(uniqid(mt_rand(),true));
if(Yii::app()->user->hasFlash('error')){
    ?>
    <div class="flashMessage">
        <?php echo Yii::app()->user->getFlash('error') ?>
    </div>
<?php
}
?>

    <input type="hidden" name="token" value="<?php echo $token ?>"/>
//Rest of the form

Now inside action Login I have the following.

// collect user input data
        if(isset($_POST['LoginForm'])){

            //Check if the token matches
            if($_POST['token'] == $_SESSION['token']){

                $model->attributes=$_POST['LoginForm'];
                // validate user input and redirect to the previous page if valid
                if($model->validate() && $model->login())
                    $this->redirect(Yii::app()->user->returnUrl);
            }
        }

Now when I try and log in i get the following error

Undefined variable: _SESSION

I don't understand why its telling that the session is not existing since it has the same name.

Any help i appricate

Answer 1

Use SESSION in Yii like one of the following methods:

1.Using Yii::app()->session

Yii::app()->session['KEY']='VALUE'; //setting session 
$key=Yii::app()->session['KEY']; //getting session

2.Using Yii's States

Yii::app()->user->setState('KEY','VALUE'); //setting session
$key=Yii::app()->user->getState('KEY'); //getting session 

But what is the differences between State and Session?

If you use setState() | State, the probability of conflicting between applications will decrease by adding a hash, as it adds a hash inside the session KEY, for example if you get a dump from $_SESSION you will see:

'0f42ca4d61b26371fee67cc51d7b48d3KEY' => 'VALUE' 

But if you use Yii::app()->session it will store the plain KEY like below:

'KEY' => 'VALUE'

---

You may check SetState(), getState() and hasState()