php class 保护 api 免受 CSRF 请求

Question

I'm looking for a PHP class to protect my RESTful API from CSRF attacks. I have seen many classes for that but all of them are used for normal pages NOT a RESTful API.

Answer 1

You write your own. Every response your api sends should have a header which is set to a long alphanumeric string. The next request you receive should contain that header. You can use a simple table for persistance.

OWASP gives a nice example implementation that you could use