php token match does not work - php

Question

i am doing form validator(using tokens).
Page is based on smarty. So in class Articles i have the followin function:
public static function getToken(){
self::$token = md5(uniqid(rand(), TRUE));
$_SESSION['token'] = self::$token;
}
Then in .tpl file i have inserted the value like this:
<input type="hidden" name="token" value="{Articles::$token}">
After the form is submitted the check is run in index.php:
if(isset($_POST['token']) && $_POST['token'] == $_SESSION['token']){
Articles::addComment($item, $_POST['name'], $_POST['email'], $_POST['comment']);
}
The issue is that I get different tokens. For example, I echoed the $_SESSION['token'] and compared in with the value in the form (view source).
Also after submit i tried to echo both values ($_SESSION ['token'] and $_POST ['token]) they are different as well. Obviously, the form is not submitting.

Answer 1

CSRF tokens need not be mapped 1:1 for users. What if you have more than one form on a page? What if a user has more than one browser window open?
Define something to store 0..n tokens, set a reasonably short validity period on them, and [optionally] define what they are valid for. Eg:
class Token {
protected $id, $expiry;
public function __construct($expiry=300, $id=NULL) {
$this->expiry = time() + $expiry;
if( is_null($id) ) {
// actual secure ID generation.
$this->id = bin2hex(random_bytes(32));
} else {
$this->id = $id;
}
}
public function getID() {
return $id;
}
public function isValid() {
return time() < $expiry;
}
}
class YourApp {
public function newToken() {
$token = new Token();
$_SESSION['tokens'][$token->getID()] = $token;
return $token
}
public function checkToken($token_id) {
if( key_exists($token_id, $_SESSION['tokens']) ) {
$cur = $_SESSION['tokens'][$token_id];
unset($_SESSION['tokens'][$token_id]; // single use only!
return $cur->isValid();
} else {
return false;
}
}
public function flushOldTokens() {
$_SESSION['tokens'] = array_filter(
$_SESSION['tokens'],
function($t){return $t->isValid();}
);
}
}