Skip to content

Commit 2b890fe

Browse files
committed
docs: add doc comments
1 parent f4c1fa4 commit 2b890fe

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

system/Security/Security.php

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ class Security implements SecurityInterface
5454
protected $tokenRandomize = false;
5555

5656
/**
57-
* CSRF Hash
57+
* CSRF Hash (without randomization)
5858
*
5959
* Random hash for Cross Site Request Forgery protection.
6060
*
@@ -88,7 +88,7 @@ class Security implements SecurityInterface
8888
protected $cookie;
8989

9090
/**
91-
* CSRF Cookie Name
91+
* CSRF Cookie Name (with Prefix)
9292
*
9393
* Cookie name for Cross Site Request Forgery protection.
9494
*
@@ -155,7 +155,10 @@ class Security implements SecurityInterface
155155
private ?Session $session = null;
156156

157157
/**
158-
* CSRF Hash in Cookie
158+
* CSRF Hash in Request Cookie
159+
*
160+
* The cookie value is always CSRF hash (without randomization) even if
161+
* $tokenRandomize is true.
159162
*/
160163
private ?string $hashInCookie = null;
161164

@@ -249,7 +252,7 @@ public function CSRFVerify(RequestInterface $request)
249252
}
250253

251254
/**
252-
* Returns the CSRF Hash.
255+
* Returns the CSRF Token.
253256
*
254257
* @deprecated Use `CodeIgniter\Security\Security::getHash()` instead of using this method.
255258
*
@@ -351,7 +354,7 @@ private function getPostedToken(RequestInterface $request): ?string
351354
}
352355

353356
/**
354-
* Returns the CSRF Hash.
357+
* Returns the CSRF Token.
355358
*/
356359
public function getHash(): ?string
357360
{
@@ -360,6 +363,10 @@ public function getHash(): ?string
360363

361364
/**
362365
* Randomize hash to avoid BREACH attacks.
366+
*
367+
* @params string $hash CSRF hash
368+
*
369+
* @return string CSRF token
363370
*/
364371
protected function randomize(string $hash): string
365372
{
@@ -376,7 +383,11 @@ protected function randomize(string $hash): string
376383
/**
377384
* Derandomize the token.
378385
*
386+
* @params string $token CSRF token
387+
*
379388
* @throws InvalidArgumentException "hex2bin(): Hexadecimal input string must have an even length"
389+
*
390+
* @return string CSRF hash
380391
*/
381392
protected function derandomize(string $token): string
382393
{

0 commit comments

Comments
 (0)