javascript – 许多AJAX请求同时使用CSRF保护

>在javascript代码中使用一堆csrf-tokens
>使用可以多次使用的csrf令牌(不太安全)
>为请求使用队列

令牌的堆栈

Slim-Csrf-middleware为您提供功能,生成这些令牌,您只需将它们带到客户端即可.
你可以用api获得5个csrf令牌,这个api也会消耗csrf-token.

添加一个api并在那里生成令牌.

$app->get('/foo',function ($request,$response,$args) {
    // check valid  csrf token

    $tokens = [];
    for ($i = 0; $i < 5; $i++) {
        $tokens[] = $this->csrf->generateToken();
    }

    return $response->withJson($tokens);
});

现在,csrf-token在整个用户会话中都有效.

Guard :: generateToken()返回如下内容：

array (size=2)
  'csrf_name' => string 'csrf58e669ff70da0' (length=17)
  'csrf_value' => string '52ac7689d3c6ea5d01889d711018f058' (length=32)

多用途csrf令牌

为此,Slim-Csrf已经提供了令牌持久性模式的功能.这可以通过构造函数或Guard :: setPersistentTokenMode(bool)方法启用.在我的例子中,我正在使用该方法：

$container['csrf'] = function ($c) {
    $guard = new \Slim\Csrf\Guard;
    $guard->setPersistentTokenMode(true);
    return $guard;
};

这里是persistanceTokenMode-attribute的PhpDoc

/**
 * Determines whether or not we should persist the token throughout the duration of the user's session.
 *
 * For security,Slim-Csrf will *always* reset the token if there is a validation error.
 * @var bool True to use the same token throughout the session (unless there is a validation error),* false to get a new token with each request.
 */

ajax请求的队列.

为请求添加一个队列,这可能会延迟执行您的请求,但总会有一个有效的csrf令牌.

这应该被视为伪代码,因为我还没有测试过.

var requestQueue = [];
var isInRequest = false;

var csrfKey = ''; // should be set on page load,to have a valid token at the start
var csrfValue = '';

function newRequest(onSuccessCallback,data) { // add all parameters you need
    // add request to the queue
    requestQueue.push(function() {
        isInRequest = true;
        // add to csrf stuff to data
        $.ajax({
            data: xxx
            url: "serverscript.xxx",success: function(data) {
                // update csrfKey & csrfValue
                isInRequest = false;
                tryExecuteNextRequest(); // try execute next request
                onSuccessCallback(data); // proceed received data
            }
        }});
    );
    tryExecuteNextRequest();
}

function tryExecuteNextRequest() {
    if(!isInRequest && requestQueue.length != 0) { // currently no request running &
        var nextRequest = requestQueue.shift();
        nextRequest(); // execute next request
    }
}