for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
/**
* @package WPEmerge
* @author Atanas Angelov <[email protected]>
* @copyright 2017-2019 Atanas Angelov
* @license https://www.gnu.org/licenses/gpl-2.0.html GPL-2.0
* @link https://wpemerge.com/
*/
namespace WPEmerge\Csrf;
use Closure;
use Psr\Http\Message\ResponseInterface;
use WPEmerge\Requests\RequestInterface;
* Store current request data and clear old request data
class CsrfMiddleware {
* CSRF service.
*
* @var Csrf
protected $csrf = null;
* Constructor.
* @param Csrf $csrf
public function __construct( $csrf ) {
$this->csrf = $csrf;
}
* Reject requests that fail nonce validation.
* @param RequestInterface $request
* @param Closure $next
* @param mixed $action
* @return ResponseInterface
* @throws InvalidCsrfTokenException
public function handle( RequestInterface $request, Closure $next, $action = -1 ) {
if ( ! $request->isReadVerb() ) {
$token = $this->csrf->getTokenFromRequest( $request );
if ( ! $this->csrf->isValidToken( $token, $action ) ) {
throw new InvalidCsrfTokenException();
$this->csrf->generateToken( $action );
return $next( $request );