CsrfManager::validate() - Code Metrics - platine-php/framework - Measure and Improve Code Quality continuously with Scrutinizer

CsrfManager::validate() A
last analyzed 2025-06-18 08:29 UTC

↳ Parent: CsrfManager

Complexity

Conditions	5
Paths	6

Size

Total Lines	17
Code Lines	9

Duplication

Lines	0
Ratio	0 %

Importance

Changes	3
Bugs	0	Features	0

Metric	Value
cc	5
eloc	9
c	3
b	0
f	0
nc	6
nop	2
dl	0
loc	17
rs	9.6111

<?php

/**
 * Platine Framework
 *
 * Platine Framework is a lightweight, high-performance, simple and elegant PHP
 * Web framework
 *
 * This content is released under the MIT License (MIT)
 *
 * Copyright (c) 2020 Platine Framework
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in all
 * copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 * SOFTWARE.
 */

/**
 *  @file CsrfManager.php
 *
 *  The CSRF manager class
 *
 *  @package    Platine\Framework\Security\Csrf
 *  @author Platine Developers team
 *  @copyright  Copyright (c) 2020
 *  @license    http://opensource.org/licenses/MIT  MIT License
 *  @link   https://www.platine-php.com
 *  @version 1.0.0
 *  @filesource
 */

declare(strict_types=1);

namespace Platine\Framework\Security\Csrf;

use Platine\Config\Config;
use Platine\Framework\Http\RequestData;
use Platine\Framework\Security\Csrf\CsrfStorageInterface;
use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
use Platine\Http\ServerRequestInterface;
use Platine\Stdlib\Helper\Str;

/**
 * @class CsrfManager
 * @package Platine\Framework\Security\Csrf
 * @template T
 */
class CsrfManager
{
    /**
     * The application configuration class
     * @var Config<T>
     */
    protected Config $config;

    /**
     * The storage to be used
     * @var CsrfStorageInterface
     */
    protected CsrfStorageInterface $storage;

    /**
     * Create new instance
     * @param Config<T> $config
     * @param CsrfStorageInterface|null $storage
     */
    public function __construct(
        Config $config,
        ?CsrfStorageInterface $storage = null
    ) {
        $this->config = $config;
        $this->storage = $storage ??  new CsrfNullStorage();
    }

    /**
     * Validate the token
     * @param ServerRequestInterface $request
     * @param string|null $key
     * @return bool
     */
    public function validate(ServerRequestInterface $request, ?string $key = null): bool
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $storageToken = $this->storage->get($key);
        if ($storageToken === null) {
            return false;
        }

        $token = $this->getRequestToken($request, $key);
        if ($token === null || $token !== $storageToken) {
            return false;
        }

        return true;
    }

    /**
     * Return the token
     * @param string|null $key
     * @return string
     */
    public function getToken(?string $key = null): string
    {
        if ($key === null) {
            $key = $this->getConfigValue('key');
        }

        $value = $this->storage->get($key);
        if ($value === null) {
            // Generate the token
            $value = sha1(Str::randomToken(24));
            $expire = $this->getConfigValue('expire') ?? 300;
            $expireTime = time() + $expire;

            $this->storage->set($key, $value, $expireTime);
        }

        return $value;
    }

    /**
     * Return the token query to be used in query string
     * @param string|null $key
     * @return array<string, string>
     */
    public function getTokenQuery(?string $key = null): array
    {
        $token = $this->getToken($key);

        if ($key === null) {
            $key = (string) $this->getConfigValue('key');
        }

        return [$key => $token];
    }

    /**
     * Clear all CSRF data from storage
     * @return void
     */
    public function clear(): void
    {
        $this->storage->clear();
    }

    /**
     * Return the token from request
     * @param ServerRequestInterface $request
     * @param string $key
     * @return string|null
     */
    protected function getRequestToken(ServerRequestInterface $request, string $key): ?string
    {
        $param = new RequestData($request);
        $token = $param->post($key);
        if ($token === null) {
            $token = $param->get($key);
        }

        if ($token === null) {
            $token = $request->getHeaderLine('X-Csrf-Token');
        }


        return $token;
    }

    /**
     * Return the CSRF configuration value
     * @param string $key
     * @return mixed
     */
    private function getConfigValue(string $key): mixed
    {
        $config = $this->config->get('security.csrf', []);

        return $config[$key] ?? null;
    }
}


1			<?php
2
3			/**
4			* Platine Framework
5			*
6			* Platine Framework is a lightweight, high-performance, simple and elegant PHP
7			* Web framework
8			*
9			* This content is released under the MIT License (MIT)
10			*
11			* Copyright (c) 2020 Platine Framework
12			*
13			* Permission is hereby granted, free of charge, to any person obtaining a copy
14			* of this software and associated documentation files (the "Software"), to deal
15			* in the Software without restriction, including without limitation the rights
16			* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
17			* copies of the Software, and to permit persons to whom the Software is
18			* furnished to do so, subject to the following conditions:
19			*
20			* The above copyright notice and this permission notice shall be included in all
21			* copies or substantial portions of the Software.
22			*
23			* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
24			* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25			* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
26			* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
27			* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
28			* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
29			* SOFTWARE.
30			*/
31
32			/**
33			* @file CsrfManager.php
34			*
35			* The CSRF manager class
36			*
37			* @package Platine\Framework\Security\Csrf
38			* @author Platine Developers team
39			* @copyright Copyright (c) 2020
40			* @license http://opensource.org/licenses/MIT MIT License
41			* @link https://www.platine-php.com
42			* @version 1.0.0
43			* @filesource
44			*/
45
46			declare(strict_types=1);
47
48			namespace Platine\Framework\Security\Csrf;
49
50			use Platine\Config\Config;
51			use Platine\Framework\Http\RequestData;
52			use Platine\Framework\Security\Csrf\CsrfStorageInterface;
53			use Platine\Framework\Security\Csrf\Storage\CsrfNullStorage;
54			use Platine\Http\ServerRequestInterface;
55			use Platine\Stdlib\Helper\Str;
56
57			/**
58			* @class CsrfManager
59			* @package Platine\Framework\Security\Csrf
60			* @template T
61			*/
62			class CsrfManager
63			{
64			/**
65			* The application configuration class
66			* @var Config<T>
67			*/
68			protected Config $config;
69
70			/**
71			* The storage to be used
72			* @var CsrfStorageInterface
73			*/
74			protected CsrfStorageInterface $storage;
75
76			/**
77			* Create new instance
78			* @param Config<T> $config
79			* @param CsrfStorageInterface\|null $storage
80			*/
81			public function __construct(
82			Config $config,
83			?CsrfStorageInterface $storage = null
84			) {
85			$this->config = $config;
86			$this->storage = $storage ?? new CsrfNullStorage();
87			}
88
89			/**
90			* Validate the token
91			* @param ServerRequestInterface $request
92			* @param string\|null $key
93			* @return bool
94			*/
95			public function validate(ServerRequestInterface $request, ?string $key = null): bool
96			{
97			if ($key === null) {
98			$key = $this->getConfigValue('key');
99			}
100
101			$storageToken = $this->storage->get($key);
102			if ($storageToken === null) {
103			return false;
104			}
105
106			$token = $this->getRequestToken($request, $key);
107			if ($token === null \|\| $token !== $storageToken) {
108			return false;
109			}
110
111			return true;
112			}
113
114			/**
115			* Return the token
116			* @param string\|null $key
117			* @return string
118			*/
119			public function getToken(?string $key = null): string
120			{
121			if ($key === null) {
122			$key = $this->getConfigValue('key');
123			}
124
125			$value = $this->storage->get($key);
126			if ($value === null) {
127			// Generate the token
128			$value = sha1(Str::randomToken(24));
129			$expire = $this->getConfigValue('expire') ?? 300;
130			$expireTime = time() + $expire;
131
132			$this->storage->set($key, $value, $expireTime);
133			}
134
135			return $value;
136			}
137
138			/**
139			* Return the token query to be used in query string
140			* @param string\|null $key
141			* @return array<string, string>
142			*/
143			public function getTokenQuery(?string $key = null): array
144			{
145			$token = $this->getToken($key);
146
147			if ($key === null) {
148			$key = (string) $this->getConfigValue('key');
149			}
150
151			return [$key => $token];
152			}
153
154			/**
155			* Clear all CSRF data from storage
156			* @return void
157			*/
158			public function clear(): void
159			{
160			$this->storage->clear();
161			}
162
163			/**
164			* Return the token from request
165			* @param ServerRequestInterface $request
166			* @param string $key
167			* @return string\|null
168			*/
169			protected function getRequestToken(ServerRequestInterface $request, string $key): ?string
170			{
171			$param = new RequestData($request);
172			$token = $param->post($key);
173			if ($token === null) {
174			$token = $param->get($key);
175			}
176
177			if ($token === null) {
178			$token = $request->getHeaderLine('X-Csrf-Token');
179			}
180
181
182			return $token;
183			}
184
185			/**
186			* Return the CSRF configuration value
187			* @param string $key
188			* @return mixed
189			*/
190			private function getConfigValue(string $key): mixed
191			{
192			$config = $this->config->get('security.csrf', []);
193
194			return $config[$key] ?? null;
195			}
196			}
197

platine-php / framework

CsrfManager::validate() A last analyzed 2025-06-18 08:29 UTC

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like

CsrfManager::validate() A
last analyzed 2025-06-18 08:29 UTC