Zend框架1.12 - 哈希表格验证返回错误

Question

I am using Zend_Form_Element_Hash to protect csrf on my website. Below is the code in my Form.php

$token = new Zend_Form_Element_Hash('token', 'csrf');
$token->setSalt(md5(uniqid(rand(), TRUE)));
$token->initCsrfToken();
$token->initCsrfValidator();
$this->addElement($token);

When I check for $form->isValid in my controller I always get the below error

The two given tokens do not match

Would appreciate any help here!

Answer 1

1. Csrf is stored in session, session name for csrf depends on salt. If salt is random, session name will be random too. So you couldn't get csrf from session to compare it with csrf from post. Make salt constant for this form.

2. Don't call initCsrfToken, this method resets csrf and is called automatically on render.

3. Better transmit salt on element creation

   $token = new Zend_Form_Element_Hash('token', 'csrf', array('salt' => 'secure'));
   $this->addElement($token);