CSRF token generation

Question

This is a question about generating CSRF tokens.

Usually I\'d like to generate a token based off of a unique piece of data associated with the user\'s session, and h

Answer 1

CSRF utilizes the user's session, so, if you don't have one, there is no CSRF.

Answer 2

There are multiple implementation of CSRF token. The key thing is whether this csrf token is generated on the client side or server side. Because the implementation changes drastically for these two scenarios and the entropy of the token as well.

For server side, SecureRandom is the preferred way but in your case you want to generate the CSRF token before any user is identified, window.crypto provides this functionality where you can generate a unguessable enough string to be used for CSRF token.

Answer 3

Try base64_encode(openssl_random_pseudo_bytes(16)). https://github.com/codeguy/php-the-right-way/issues/272#issuecomment-18688498 and I used it for my form example in https://gist.github.com/mikaelz/5668195