Zend Framework1应用程序上的CSRF全局保护

Question

I need to add CSRF protection on ZF1 project globally. I know how to add for single form but I have already created lots of form in the project. So to do it for each and every form is very tedious and very time consuming job. I need a plug-in or any library for ZF1 that add a layer on top of every form element and receives post request with CSRF token on every form. Any logic to implement this is highly appreciated.

Answer 1

只需使用您自己的CustomForm扩展Zend_Form并在init()函数中添加csrf字段创建即可。

Answer 2

This blog post explains how to add CSRF as an after thought.

Basically you need two things:

1. JavaScript to catch ajax posts and form post events, where you inject a CSRF code into the form data before submit.
2. A preDispatch plugin in Zend that checks the CSRF token on POST requests.