CSRF attacks and token protection in PHP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this CSRF token check code?

Consider this PHP code snippet that checks a CSRF token from a form submission. What will it output if the submitted token matches the session token?

PHP

<?php
session_start();
$_SESSION['csrf_token'] = 'abc123';
$submitted_token = 'abc123';
// Simulate form submission
$_POST['csrf_token'] = $submitted_token;
if (isset($_POST['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {
    echo 'Token valid';
} else {
    echo 'Token invalid';
}

A Token invalid

B Session not started error

C Undefined index error

D Token valid

💡 Hint

Check if the submitted token matches the session token exactly.

The code sets the session token to 'abc123' and simulates a form submission with the same token. The condition passes, so it prints 'Token valid'.

🧠 Conceptual

intermediate

Which option best describes the purpose of a CSRF token?

What is the main reason web applications use CSRF tokens?

A To verify that form submissions come from the legitimate user session

B To encrypt user passwords before storing them

C To speed up page loading by caching forms

D To track user activity across different websites

💡 Hint

Think about how CSRF tokens protect against unauthorized form submissions.

CSRF tokens ensure that form submissions are made intentionally by the user and not by attackers forging requests.

🔧 Debug

advanced

Why does this CSRF token check always fail?

Look at this PHP code snippet. It tries to check a CSRF token but always prints 'Token invalid'. What is the bug?

PHP

<?php
session_start();
$_SESSION['csrf_token'] = 'token123';
if ($_POST['csrf_token'] === $_SESSION['csrf_token']) {
    echo 'Token valid';
} else {
    echo 'Token invalid';
}
// Simulate form submission
$_POST['csrf_token'] = 'token123';

A The session token is overwritten after the check

B The $_POST['csrf_token'] is checked before it is set

C The token comparison uses assignment operator instead of equality

D The session is not started before accessing $_SESSION

💡 Hint

Check the order of operations and when $_POST['csrf_token'] is set.

The code checks $_POST['csrf_token'] before it is set, so the condition fails. Setting $_POST['csrf_token'] after the check means the check always compares null to the token.

📝 Syntax

advanced

Which option contains a syntax error in CSRF token generation?

Which PHP code snippet will cause a syntax error when generating a CSRF token?

A $_SESSION['csrf_token'] = bin2hex(random_bytes(32))

B $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); echo 'Token set';

C $_SESSION['csrf_token'] = bin2hex(random_bytes(32));

D $_SESSION['csrf_token'] = bin2hex(random_bytes(32));;

💡 Hint

Look carefully for missing semicolons.

Option A is missing a semicolon at the end of the statement, causing a syntax error.

🚀 Application

expert

How many items are in the CSRF token array after this code runs?

This PHP code stores multiple CSRF tokens for different forms in the session. How many tokens are stored in $_SESSION['csrf_tokens'] after running?

PHP

<?php
session_start();
$_SESSION['csrf_tokens'] = [];
for ($i = 1; $i <= 3; $i++) {
    $_SESSION['csrf_tokens']['form' . $i] = bin2hex(random_bytes(16));
}
unset($_SESSION['csrf_tokens']['form2']);

A 1

B 0

C 2

D 3

💡 Hint

Count how many tokens are added and then removed.

The loop adds 3 tokens with keys 'form1', 'form2', 'form3'. Then 'form2' is removed, leaving 2 tokens.

Practice

1. What is the main purpose of a CSRF token in a PHP web application?

easy

A. To speed up the loading time of the website

B. To prevent unauthorized commands from being transmitted from a user the website trusts

C. To encrypt user passwords before storing them

D. To validate user input format on forms

Solution

1. Step 1: Understand CSRF attack basics

   CSRF attacks trick a user into submitting unwanted actions on a trusted site.

2. Step 2: Role of CSRF token

   A CSRF token is a unique value that verifies the request is from the legitimate user, preventing unauthorized commands.

3. Final Answer:

   To prevent unauthorized commands from being transmitted from a user the website trusts -> Option B

4. Quick Check:

   CSRF token purpose = prevent unauthorized commands [OK]

Hint: CSRF tokens stop fake requests from trusted users [OK]

Common Mistakes:

• Confusing CSRF tokens with password encryption
• Thinking CSRF tokens speed up websites
• Believing CSRF tokens validate input format

2. Which PHP function is commonly used to generate a CSRF token?

easy

A. random_bytes()

B. md5()

C. htmlspecialchars()

D. strtoupper()

Solution

1. Step 1: Identify secure token generation

   CSRF tokens must be random and hard to guess, so secure random functions are used.

2. Step 2: Choose the correct function

   random_bytes() generates cryptographically secure random bytes, suitable for tokens.

3. Final Answer:

   random_bytes() -> Option A

4. Quick Check:

   Secure token generation = random_bytes() [OK]

Hint: Use random_bytes() for secure token generation [OK]

Common Mistakes:

• Using md5() which is not secure for tokens
• Confusing htmlspecialchars() with token generation
• Using strtoupper() which only changes case

3. What will the following PHP code output if the CSRF token in session matches the token sent in POST?

$_SESSION['csrf_token'] = 'abc123';
if (isset($_POST['csrf_token']) && $_POST['csrf_token'] === $_SESSION['csrf_token']) {
    echo 'Valid request';
} else {
    echo 'Invalid request';
}

medium

A. No output

B. Invalid request

C. Valid request

D. Undefined index error

Solution

1. Step 1: Check token comparison logic

   The code compares the POST token with the session token for equality.

2. Step 2: When tokens match

   If tokens match, it echoes 'Valid request'. If not, 'Invalid request'.

3. Final Answer:

   Valid request -> Option C

4. Quick Check:

   Matching tokens = Valid request [OK]

Hint: Matching tokens means valid request output [OK]

Common Mistakes:

• Assuming error if POST token is set correctly
• Ignoring isset() check causing errors
• Thinking output is empty when tokens match

4. Identify the error in this PHP CSRF token validation snippet:

session_start();
if ($_POST['csrf_token'] == $_SESSION['csrf_token']) {
    echo 'Token valid';
} else {
    echo 'Token invalid';
}

medium

A. session_start() should be called after token check

B. Using == instead of === causes token mismatch

C. Tokens should be compared with strtolower()

D. Missing check if $_POST['csrf_token'] is set before comparing

Solution

1. Step 1: Analyze token existence check

   The code compares $_POST['csrf_token'] without verifying if it exists, risking undefined index error.

2. Step 2: Importance of isset()

   Using isset() prevents errors by ensuring the token is present before comparison.

3. Final Answer:

   Missing check if $_POST['csrf_token'] is set before comparing -> Option D

4. Quick Check:

   Check token existence before compare = Missing isset() [OK]

Hint: Always check if POST token exists before comparing [OK]

Common Mistakes:

• Ignoring isset() causing runtime errors
• Thinking == vs === affects token validation here
• Calling session_start() after token check

5. You want to protect a PHP form from CSRF attacks. Which sequence correctly implements token generation, embedding, and validation? A) Generate token on form display, store in session, embed in hidden input, then check token on form submission. B) Generate token on form submission, embed in hidden input, then store in session. C) Store token in session after form submission, then generate token and embed in form. D) Embed a static token in the form and check it on submission without session.

hard

A. Generate token on form display, store in session, embed in hidden input, then check token on form submission.

B. Generate token on form submission, embed in hidden input, then store in session.

C. Store token in session after form submission, then generate token and embed in form.

D. Embed a static token in the form and check it on submission without session.

Solution

1. Step 1: Token generation and storage

   Token must be generated before showing the form and stored in session to verify later.

2. Step 2: Embedding and validation

   Embed the token in a hidden form field and check it against the session token on submission.

3. Final Answer:

   Generate token on form display, store in session, embed in hidden input, then check token on form submission. -> Option A

4. Quick Check:

   Token lifecycle = generate, store, embed, validate [OK]

Hint: Generate and store token before form, validate after submission [OK]

Common Mistakes:

• Generating token after form submission
• Not storing token in session
• Using static tokens without session storage