src/Security/CSRF.php
public function checkToken($string, $action = null, $tokenValidity = null)
    {
        // Get token data from session
        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);
        if (!isset($tokenStorage[$index])) {
            return false;
        }
        $tokenData = $tokenStorage[$index];

        // Check token expiration
        if ($this->isExpired($tokenData, $tokenValidity)) {
            $this->ivalidateToken($index, $tokenStorage);
            return false;
        }
        
        // Check correct format of received token
        $parts = explode(self::TOKEN_DELIMTER, $string);
        if (count($parts) !== 2) {
            return false;
        }

        // Validate the token
        $trueToken = $tokenData['token'];
        $key = $parts[0];           // A key used to create a keyed hash of the real token
        $tokenHMAC = $parts[1];     // Keyed hash of the real token
        $trueTokenHMAC = $this->tokenHMAC($trueToken, $key);
        $isValid = \hash_equals($trueTokenHMAC, $tokenHMAC);
        
        // Remove if it is a one-time token
        if ($isValid && !$tokenData['reuse']) {
            $this->ivalidateToken($index, $tokenStorage);
        }
        
        return $isValid;
    }
public function checkToken($string, $action = null, $tokenValidity = null)
    {
        // Get token data from session
        $index = ($action) ? $action : self::DEFAULT_SELECTOR;
        $tokenStorage = $this->session->get(self::SESSION_KEY, []);
        if (!isset($tokenStorage[$index])) {
            return false;
        }
        $tokenData = $tokenStorage[$index];

        // Check token expiration
        if ($this->isExpired($tokenData, $tokenValidity)) {
            $this->ivalidateToken($index, $tokenStorage);
            return false;
        }
        
        // Check correct format of received token
        $parts = explode(self::TOKEN_DELIMTER, $string);
        if (count($parts) !== 2) {
            return false;
        }

        // Validate the token
        $trueToken = $tokenData['token'];
        $key = $parts[0];           // A key used to create a keyed hash of the real token
        $tokenHMAC = $parts[1];     // Keyed hash of the real token
        $trueTokenHMAC = $this->tokenHMAC($trueToken, $key);
        $isValid = \hash_equals($trueTokenHMAC, $tokenHMAC);
        
        // Remove if it is a one-time token
        if ($isValid && !$tokenData['reuse']) {
            $this->ivalidateToken($index, $tokenStorage);
        }
        
        return $isValid;
    }
public function checkToken ( $ string , $ action = null , $ tokenValidity = null ) { // Get token data from session $ index = ( $ action ) ? $ action : self :: DEFAULT_SELECTOR ; $ tokenStorage = $ this -> session -> get ( self :: SESSION_KEY , [ ] ) ; if ( ! isset ( $ tokenStorage [ $ index ] ) ) { return false ; } $ tokenData = $ tokenStorage [ $ index ] ; // Check token expiration if ( $ this -> isExpired ( $ tokenData , $ tokenValidity ) ) { $ this -> ivalidateToken ( $ index , $ tokenStorage ) ; return false ; } // Check correct format of received token $ parts = explode ( self :: TOKEN_DELIMTER , $ string ) ; if ( count ( $ parts ) !== 2 ) { return false ; } // Validate the token $ trueToken = $ tokenData [ 'token' ] ; $ key = $ parts [ 0 ] ; // A key used to create a keyed hash of the real token $ tokenHMAC = $ parts [ 1 ] ; // Keyed hash of the real token $ trueTokenHMAC = $ this -> tokenHMAC ( $ trueToken , $ key ) ; $ isValid = \ hash_equals ( $ trueTokenHMAC , $ tokenHMAC ) ; // Remove if it is a one-time token if ( $ isValid && ! $ tokenData [ 'reuse' ] ) { $ this -> ivalidateToken ( $ index , $ tokenStorage ) ; } return $ isValid ; }
Token validation
@param string $string token string to be validated
@param string $action action the validated token is associated with
@return boolean true on successful validation
Token validation