Created
June 5, 2018 19:14
-
-
Save ReallyNotARussianSpy/4003e6f45f82dc845ff75684aecd98ba to your computer and use it in GitHub Desktop.
PHP function to be used in Magento in conjunction with Cloudflare Workers to determine if a client's CSRF token is valid
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
/** | |
* Returns whether the given CSRF token is valid | |
* | |
* @param string $token The CSRF token given by the client | |
* | |
* @author Scott Reed <[email protected]> | |
* @return boolean | |
*/ | |
function isTokenValid($token) | |
{ | |
$client_csrf_token = Mage::getModel('core/cookie')->get('csrf_token'); | |
$cfduid = Mage::getModel('core/cookie')->get('__cfduid'); | |
$shared_secret = '$F#$f34#I$&Y#$&#YF8#&4tf86#$KJSHFJKSHDFKLSDHFKHSFW$F$^GSKDFSJFDFJHWWFSDFPjay'; | |
$valid_token = hash('sha256', $cfduid . $shared_secret); | |
if ($client_csrf_token == $valid_token) { | |
return true; | |
} | |
return false; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment