Question

I want to make sure I’m understanding and applying the token correctly to avoid CSRF?

My data line in my jQuery ajax request:

data:{ Id:getParameterByName("id"), Token:"<?php echo $csfrToken; ?>" },

My PHP check inside the file that handles the posted data:

if (isset($_SESSION['TOKEN']) && $_SESSION['TOKEN'] == $_POST['Token']) { }

Is there anything else I need to do with an ajax request. All I’m doing is creating a token on the page that contains the ajax request. I then post that created token to my ajax handler page and then check to make sure they are the same. Is there anything else that needs to be done?

Answer 1

Looks good what you did. That is how Zend Framework’s Zend_Form_Element_Hash does it for forms and this also applys to AJAX requests.