@@ -54,7 +54,7 @@ class Security implements SecurityInterface
54
54
protected $ tokenRandomize = false ;
55
55
56
56
/**
57
- * CSRF Hash
57
+ * CSRF Hash (without randomization)
58
58
*
59
59
* Random hash for Cross Site Request Forgery protection.
60
60
*
@@ -88,7 +88,7 @@ class Security implements SecurityInterface
88
88
protected $ cookie ;
89
89
90
90
/**
91
- * CSRF Cookie Name
91
+ * CSRF Cookie Name (with Prefix)
92
92
*
93
93
* Cookie name for Cross Site Request Forgery protection.
94
94
*
@@ -155,7 +155,10 @@ class Security implements SecurityInterface
155
155
private ?Session $ session = null ;
156
156
157
157
/**
158
- * CSRF Hash in Cookie
158
+ * CSRF Hash in Request Cookie
159
+ *
160
+ * The cookie value is always CSRF hash (without randomization) even if
161
+ * $tokenRandomize is true.
159
162
*/
160
163
private ?string $ hashInCookie = null ;
161
164
@@ -249,7 +252,7 @@ public function CSRFVerify(RequestInterface $request)
249
252
}
250
253
251
254
/**
252
- * Returns the CSRF Hash .
255
+ * Returns the CSRF Token .
253
256
*
254
257
* @deprecated Use `CodeIgniter\Security\Security::getHash()` instead of using this method.
255
258
*
@@ -351,7 +354,7 @@ private function getPostedToken(RequestInterface $request): ?string
351
354
}
352
355
353
356
/**
354
- * Returns the CSRF Hash .
357
+ * Returns the CSRF Token .
355
358
*/
356
359
public function getHash (): ?string
357
360
{
@@ -360,6 +363,10 @@ public function getHash(): ?string
360
363
361
364
/**
362
365
* Randomize hash to avoid BREACH attacks.
366
+ *
367
+ * @params string $hash CSRF hash
368
+ *
369
+ * @return string CSRF token
363
370
*/
364
371
protected function randomize (string $ hash ): string
365
372
{
@@ -376,7 +383,11 @@ protected function randomize(string $hash): string
376
383
/**
377
384
* Derandomize the token.
378
385
*
386
+ * @params string $token CSRF token
387
+ *
379
388
* @throws InvalidArgumentException "hex2bin(): Hexadecimal input string must have an even length"
389
+ *
390
+ * @return string CSRF hash
380
391
*/
381
392
protected function derandomize (string $ token ): string
382
393
{
0 commit comments