CSRF tokem for submit form - php

Question

I'm generating a form submission security token in software.
The idea is to generate a token as soon as the user arrives on the page hosting the form
Allow the user to fill in the form
And only if the token initialized as soon as the user landed on the page is the same as the one in an input field, then run the code, otherwise no
This is to avoid CSRF
Methodology
1: Create a function that generates a token | create a file: config.php
function RandomToken($length = 32){
if(!isset($length) || intval($length) <= 8 ){
$length = 32;
}
if (function_exists('random_bytes')) {
return bin2hex(random_bytes($length));
}
if (function_exists('mcrypt_create_iv')) {
return bin2hex(mcrypt_create_iv($length, MCRYPT_DEV_URANDOM));
}
if (function_exists('openssl_random_pseudo_bytes')) {
return bin2hex(openssl_random_pseudo_bytes($length));
}
}
function Salt(){
return substr(strtr(base64_encode(hex2bin(RandomToken(32))), '+', '.'), 0, 44);
}
$token = (RandomToken())."\n".Salt()."\n";
2: include config.php, in the file hosting the form
3: write the rules
if (isset($_POST['submit']))
{
session_start();
$_SESSION['t'] = $token;
if ( ($_SESSION['t'] === $_POST['csrf_token_p']))
{
/* write code if this is correct */
}else{
/* write code if this it's not correct */
}
}
4: write the form
<form action="page.php" method="post">
<input type="text" name="csrf_token_p" value="<?php echo $token ?>">
<input name="submit" value="modifica" type="submit">
</form>
error: I always get that the two tokens do not match. why?
edit part
config.php
<?php ob_start(); session_start();
/*
* https://www.php.net/manual/en/function.random-bytes.php
* funzione per la creazione di un codice unico contro i CSRF attack
* */
function RandomToken($length = 32){
if(!isset($length) || intval($length) <= 8 ){
$length = 32;
}
if (function_exists('random_bytes')) {
return bin2hex(random_bytes($length));
}
if (function_exists('mcrypt_create_iv')) {
return bin2hex(mcrypt_create_iv($length, MCRYPT_DEV_URANDOM));
}
if (function_exists('openssl_random_pseudo_bytes')) {
return bin2hex(openssl_random_pseudo_bytes($length));
}
}
function Salt(){
return substr(strtr(base64_encode(hex2bin(RandomToken(32))), '+', '.'), 0, 44);
}
$token = (RandomToken())."\n".Salt()."\n";
session_start();
$_SESSION['t'] = randomToken();
/*------------------------------------------------------------------------------------------------------------*/
form-page.php
<?php ob_start(); session_start();
include '../connection/cnt.php';
?>
if (isset($_POST['submit'])){
session_start();
if (!empty($_POST))
{
if (!array_key_exists('csrf_token_p', $_POST))
{
$_POST['t'] = null;
?>
<script type="text/javascript">
window.location = "p_tl.php?edit=Y";
</script>
<?php
}
if ($_SESSION['t'] !== $_POST['csrf_token_p'])
{
// BAD TOKEN! BAD!
?>
<script type="text/javascript">
window.location = "p_tl.php?edit=N";
</script>
<?php
}
}
}
?>
<form id="validate" action="p_tl.php" method="post" class="needs-validation" novalidate>
<input style="display: " type="text" name="csrf_token_p" value="<?php echo $token ?>" class="form-control" id="validationCustom01"
required>
<input
style="background-color: #9da1a4;color: #fff;"
name="submit"
value="modifica"
class="btn btn-sm"
type="submit">
</form>

Answer 1

This is wrong:
if (isset($_POST['submit'])) {
session_start();
$_SESSION['t'] = $token;
You need to start the session in config, and create and save the token there. Because that is the flow that will create the form. Otherwise, a different session will be opened upon submit.
So:
config.php
session_start();
$token = randomToken();
$_SESSION['t'] = $token;
print "<form...";
// In produzione, cambia questo in "hidden", non "text"
print "<input type=\"text\" name="csrf_token_p" value=\"{$token}\" />";
// The rest of the form with submit button
print "</form>";
form_receive.php
session_start();
if (!empty($_POST)) {
if (!array_key_exists('csrf_token_p', $_POST)) {
$_POST['t'] = null;
}
if ($_SESSION['t'] !== $_POST['csrf_token_p']) {
// BAD TOKEN! BAD!
die("Token mismatch");
}
// Okay.