yii的csrf使用

csrf的思想：

-------------------------------------------------------------

yii使用：

1. 在表单中加一个隐藏域

<div id="tokenId" type="hidden"><?php $this->useCsrfToken();?></div>

public function useCsrfToken(){
$request=Yii::app()->request;
echo CHtml::hiddenField($request->csrfTokenName,$request->getCsrfToken(),array('id'=>false));
}

2. 在后台提供订单后验证

public function validateCsrfToken()
{
$request=Yii::app()->request;
if($request->getIsPostRequest())
{
// only validate POST requests
$cookies=$request->getCookies();
if($cookies->contains($request->csrfTokenName) && isset($_POST[$request->csrfTokenName]))
{
$tokenFromCookie=$cookies->itemAt($request->csrfTokenName)->value;
$tokenFromPost=$_POST[$request->csrfTokenName];
$valid=$tokenFromCookie===$tokenFromPost;
}
else
$valid=false;
if(!$valid){
if (Yii::app()->request->isAjaxRequest) {
echo Controller::TOKENERROR;
Yii::app()->end();
} else {
@header('HTTP/1.1 403 Forbidden');
$_SERVER['HTTP_REFERER'] = isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'NO_HTTP_REFERER';
YiiLog('令牌错误, 非法请求! -'.json_encode($_POST).'|'.$_SERVER['REQUEST_URI'].'|'.$_SERVER['HTTP_REFERER']);
Yii::app()->end();
}
}
}
}

其实就是，判断cookie里的值和表单隐藏字段的那个值是不是相同。