Document HMAC CSRF token selection#90
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR switches the config-plugin’s default CSRF token implementation from the synchronizer pattern to a masked HMAC token, updates the default HMAC parameters (env-based secret + short lifetime), and expands documentation and tests to reflect the new defaults.
Changes:
- Default
CsrfTokenInterfacebinding now decoratesHmacCsrfTokenwithMaskedCsrfToken. - HMAC defaults now read
YII_CSRF_SECRET_KEYand use a 300-second lifetime. - README documentation and config tests updated to cover the new default behavior and env-based secret configuration.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
config/di-web.php |
Switches the default DI binding to use HmacCsrfToken under MaskedCsrfToken. |
config/params.php |
Changes HMAC parameter defaults to read the secret from YII_CSRF_SECRET_KEY and sets a 300s lifetime. |
README.md |
Documents HMAC vs synchronizer tradeoffs and how to switch back to synchronizer. |
tests/ConfigTest.php |
Adds coverage to ensure the default decorated token is HMAC and that the secret can come from the environment. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 'secretKey' => (string) getenv('YII_CSRF_SECRET_KEY'), | ||
| 'algorithm' => 'sha256', | ||
| 'lifetime' => null, | ||
| 'lifetime' => 300, |
| $this->assertInstanceOf(MaskedCsrfToken::class, $csrfToken); | ||
| $this->assertInstanceOf(HmacCsrfToken::class, $this->getDecoratedToken($csrfToken)); |
| Use HMAC when protected forms are available only to authenticated users, token revocation on logout is not required, | ||
| and every environment has its own secret key. The default config reads the key from `YII_CSRF_SECRET_KEY`. | ||
| Set it to a high-entropy value and keep `yiisoft/csrf` `hmacToken` `lifetime` short, typically a few minutes. | ||
|
|
samdark
changed the title
Co-authored-by: Alexander Makarov <sam@rmcreative.ru>
What changed
MaskedCsrfToken.The config-plugin default remains synchronizer token to avoid a behavioral BC break for applications that rely on
stateful token semantics.
Verification
vendor/bin/phpunit tests/ConfigTest.php --testdoxvendor/bin/phpunit --testdoxgit diff --checkEarlier verification also exercised HMAC in a real PHP app with a real session cookie, rendered form token, and
CsrfTokenMiddleware: valid token returned200 accepted, invalid token returned422 Unprocessable entity.