Skip to content

Instantly share code, notes, and snippets.

@ReallyNotARussianSpy
Created June 5, 2018 19:14
Show Gist options
  • Save ReallyNotARussianSpy/4003e6f45f82dc845ff75684aecd98ba to your computer and use it in GitHub Desktop.
Save ReallyNotARussianSpy/4003e6f45f82dc845ff75684aecd98ba to your computer and use it in GitHub Desktop.
PHP function to be used in Magento in conjunction with Cloudflare Workers to determine if a client's CSRF token is valid
<?php
/**
* Returns whether the given CSRF token is valid
*
* @param string $token The CSRF token given by the client
*
* @author Scott Reed <[email protected]>
* @return boolean
*/
function isTokenValid($token)
{
$client_csrf_token = Mage::getModel('core/cookie')->get('csrf_token');
$cfduid = Mage::getModel('core/cookie')->get('__cfduid');
$shared_secret = '$F#$f34#I$&Y#$&#YF8#&4tf86#$KJSHFJKSHDFKLSDHFKHSFW$F$^GSKDFSJFDFJHWWFSDFPjay';
$valid_token = hash('sha256', $cfduid . $shared_secret);
if ($client_csrf_token == $valid_token) {
return true;
}
return false;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment