CSRF attacks and token protection in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this CSRF token check code?

Consider this PHP code snippet that checks a CSRF token from a form submission. What will it output if the submitted token matches the session token?

PHP

<?php
session_start();
$_SESSION['csrf_token'] = 'abc123';
$submitted_token = 'abc123';
// Simulate form submission
$_POST['csrf_token'] = $submitted_token;
if (isset($_POST['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {
    echo 'Token valid';
} else {
    echo 'Token invalid';
}

A Token invalid

B Session not started error

C Undefined index error

D Token valid

💡 Hint

Check if the submitted token matches the session token exactly.

The code sets the session token to 'abc123' and simulates a form submission with the same token. The condition passes, so it prints 'Token valid'.

🧠 Conceptual

intermediate

Which option best describes the purpose of a CSRF token?

What is the main reason web applications use CSRF tokens?

A To verify that form submissions come from the legitimate user session

B To encrypt user passwords before storing them

C To speed up page loading by caching forms

D To track user activity across different websites

💡 Hint

Think about how CSRF tokens protect against unauthorized form submissions.

CSRF tokens ensure that form submissions are made intentionally by the user and not by attackers forging requests.

🔧 Debug

advanced

Why does this CSRF token check always fail?

Look at this PHP code snippet. It tries to check a CSRF token but always prints 'Token invalid'. What is the bug?

PHP

<?php
session_start();
$_SESSION['csrf_token'] = 'token123';
if ($_POST['csrf_token'] === $_SESSION['csrf_token']) {
    echo 'Token valid';
} else {
    echo 'Token invalid';
}
// Simulate form submission
$_POST['csrf_token'] = 'token123';

A The session token is overwritten after the check

B The $_POST['csrf_token'] is checked before it is set

C The token comparison uses assignment operator instead of equality

D The session is not started before accessing $_SESSION

💡 Hint

Check the order of operations and when $_POST['csrf_token'] is set.

The code checks $_POST['csrf_token'] before it is set, so the condition fails. Setting $_POST['csrf_token'] after the check means the check always compares null to the token.

📝 Syntax

advanced

Which option contains a syntax error in CSRF token generation?

Which PHP code snippet will cause a syntax error when generating a CSRF token?

A $_SESSION['csrf_token'] = bin2hex(random_bytes(32))

B $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); echo 'Token set';

C $_SESSION['csrf_token'] = bin2hex(random_bytes(32));

D $_SESSION['csrf_token'] = bin2hex(random_bytes(32));;

💡 Hint

Look carefully for missing semicolons.

Option A is missing a semicolon at the end of the statement, causing a syntax error.

🚀 Application

expert

How many items are in the CSRF token array after this code runs?

This PHP code stores multiple CSRF tokens for different forms in the session. How many tokens are stored in $_SESSION['csrf_tokens'] after running?

PHP

<?php
session_start();
$_SESSION['csrf_tokens'] = [];
for ($i = 1; $i <= 3; $i++) {
    $_SESSION['csrf_tokens']['form' . $i] = bin2hex(random_bytes(16));
}
unset($_SESSION['csrf_tokens']['form2']);

A 1

B 0

C 2

D 3

💡 Hint

Count how many tokens are added and then removed.

The loop adds 3 tokens with keys 'form1', 'form2', 'form3'. Then 'form2' is removed, leaving 2 tokens.