CSRF

csfr仕組み csfr仕組み

    if($this->request->is('post') ){
      $tokenHidden = $this->request->data['User']['Token'];
      $tokenSession = $this->Session->read('Token');


      if($tokenHidden == $tokenSession){
        debug("Tokenおなじです");
      }else{
        debug("Tokenちがうよ");
      }

       $this->set('token', $this->Session->read('Token'));
   
     }else{
        //GET時Tokenセット
        $this->Session->delete('Token');
        $uid = sha1(uniqid(mt_rand(), true));
        $this->Session->write('Token', $uid);
        $this->request->data['User']['Token']=$uid;

    }