Storing PHP token in session but it keep changing automatically - php

Question

I have a form and I want it to be as secure as possible. So I have this function that generates a Form Token.
function generateFormToken($form) {
// generate a token from an unique value
$token = hash('sha256', uniqid(microtime()));
// Write the generated token to the session variable to check it against the hidden field when the form is sent
$_SESSION[$form.'_token'] = (string)$token;
return $token;
}
Here is how it is activated:
if (empty($_POST)){
$newToken = generateFormToken('form1');
}
Here is the function I use to check it:
function verifyFormToken($form) {
// check if a session is started and a token is transmitted, if not return an error
if(!isset($_SESSION[$form.'_token'])) {
return false;
}
// check if the form is sent with token in it
if(!isset($_POST['token'])) {
return false;
}
// compare the tokens against each other if they are still the same
if ($_SESSION[$form.'_token'] !== $_POST['token']) {
return false;
}
return true;
}
My HTML form has a hidden input in which I put the new token variable. The form is sending to the same page via form action="#".
The problem that I have is that for some reason, when the page refresh, even though the function is not calling again, the token changes in the session but it stays the same in the form.
I'm really lost since I thought that asking PHP to store a string in a session it wouldn't change when the page refreshed under these conditions, but it keeps giving me a different response. I tried to call die() before when it enters the function to make sure that the function was not somehow loading again farther in the script, but nothing happens. It should in theory not refresh.
Help me please.
Here is the HTML Form:
<form action="#" method="POST" id="form1">
<label for="firstname">Firstname</label>
<input type="text" name="firstname">
<input type="hidden"name="token" value="<?= $newToken; ?>">
</form>
And here is the validation logic that I use at the top of my page:
$msg = "";
//If the form has been filled
if (!empty($_POST)){
//If the form has been sent from our website
if (verifyFormToken('form1') == true){
//TODO CAPTCHA
if (1 == 1){
//Everything's fine
}
else{
$msg = 'Veuillez cocher la case «Je ne suis pas un robot».';
}
}
//Else, user tried to send data with his own script (Possible XSS attack)
else{
$msg = 'Veuillez utiliser le formulaire directement sur notre site Web afin d\'appliquer sur l\'offre d\'emploi';
}
}
else{
//If form is not sent, we generate a new token and store it in the user's session
$newToken = generateFormToken('form1');
}
if (!empty($msg)){
echo $msg;
}

Answer 1

Usually, when a $_SESSION token is changing even though you set it properly, it is because you haven't set session_start() properly.
Try looking at the beginning of the file and add a session_start() there if you haven't already

Answer 2

You're missing an ending semi-colon in your code: <input type="hidden" value="<?= $newToken ?>">. This -> $newToken;

Answer 3

The following has been tested.
Apache version: 2.2.29, PHP version: 5.4.24, MySQL version: 5.5.42-37.1, Architecture: x86_64, Operating system: linux
form.php
<?php
include('so-sessions.php');
$form = "form1"; // set form id
// check if form has been submitted
IF (isset($_POST['token'])) {
$msg = ""; // default response
// Validate Token
IF (VerifyFormToken($form)) {
$msg = "Token is valid";
}ELSE{
$msg = "Token is invalid";
}
echo("<p>".$msg."</p>");
}ELSE{
// form not submitted
$token = Set_TokenSession($form); // Set token
// debugging
echo("<p>Token: ".$token."</p>");
// form
echo('
<form action="#" method="post" id="'.$form.'">
<input type="hidden" name="token" value="'.$token.'">
<label for="firstname">First Name: </label><input type="text" name="firstname" />
<input type="submit" name="submit" value="submit" />
</form>');
}
?>
so-sessions.php
<?php
Function HasSessionStarted() {
$result = false; // default to false
// Check if session has started
IF ((session_status() == PHP_SESSION_NONE) || (session_id() == '')) {
$result = true;
}
return $result;
}
Function GenerateFormToken() {
// Create token
$result = hash('sha256', uniqid(microtime()));
return $result;
}
Function Set_TokenSession($form) {
$new_session = HasSessionStarted(); // Check Session Status
$token = GenerateFormToken(); // Create token
// If the session hasn't started do so
IF ($new_session) { session_start(); }
// Unset any pre-set token
Unset_TokenSession($form);
// Set new session token
$_SESSION[$form.'_token'] = $token;
// End the current session and store session data
IF ($new_session) { session_write_close(); }
return $token;
}
Function Unset_TokenSession($form) {
$new_session = HasSessionStarted(); // Check Session Status
IF ($new_session) { session_start(); }
// Unset session token
IF (isset($_SESSION[$form.'_token'])) { unset($_SESSION[$form.'_token']); }
// End the current session and store session data
IF ($new_session) { session_write_close(); }
}
Function VerifyFormToken($form) {
$result = false; // default result to fail
$new_session = HasSessionStarted(); // Check Session Status
IF ($new_session) { session_start(); }
$sesstoken = $_SESSION[$form.'_token'];
Unset_TokenSession($form); // Unset the used token
IF ($new_session) { session_write_close(); }
// debugging
#echo("<!-- Tokens (Form/Session) : ".$_POST['token']." / ".$sesstoken." -->");
// check if session and post token are not empty
IF ((!empty($sesstoken)) && (!empty($_POST['token']))) {
// compare the tokens against each other
IF ($sesstoken == $_POST['token']) {
$result = true;
}
}
return $result;
}
?>