slim/csrf

What's Changed

• Support PHP 8.4 & 8.5 by @akrabat in #195

Full Changelog: 1.5.0...1.5.1

• Added: Support for PHP 8.4 and 8.5

What's Changed

• Bump psr/http-message requirement from '^1.0' to '^1.0 || ^2.0' by @odan in #184
• Support PHP 8.2 and 8.3 by @akrabat in #177

New Contributors

• @odan made their first contribution in #184

Full Changelog: 1.4.0...1.5.0

• Added: Support for PHP 8.2 and 8.3
• Added: Support for psr/http-message 2.0 in addition to 1.0

What's Changed

• Update phpspec/prophecy requirement from ^1.15 to ^1.16 by @dependabot in #167
• Update phpspec/prophecy requirement from ^1.16 to ^1.17 by @dependabot in #169
• Update phpunit/phpunit requirement from ^9.5 to ^9.6 by @dependabot in #170
• Update phpspec/prophecy-phpunit requirement from ^2.0 to ^2.1 by @dependabot in #172
• Update squizlabs/php_codesniffer requirement from ^3.7 to ^3.8 by @dependabot in #173
• Update phpspec/prophecy requirement from ^1.17 to ^1.18 by @dependabot in #174
• Allow tokens via header by @blizzz in #175

New Contributors

• @blizzz made their first contribution in #175

Full Changelog: 1.3.0...1.4.0

• Added: Allow to set token name and value in header

Total issues resolved: 13

• 133: Upgrade to GitHub-native Dependabot thanks to @dependabot-preview[bot]
• 134: Update phpspec/prophecy requirement from ^1.12 to ^1.13 thanks to @dependabot[bot]
• 135: Update squizlabs/php_codesniffer requirement from ^3.5.8 to ^3.6.0 thanks to @dependabot[bot]
• 137: Update phpspec/prophecy requirement from ^1.13 to ^1.14 thanks to @dependabot[bot]
• 138: Add github actions workflow thanks to @l0gicgate
• 140: Bug in enforcing storage limit, grew too large in many cases. thanks to @deployHuman
• 141: Update squizlabs/php_codesniffer requirement from ^3.6.0 to ^3.6.1 thanks to @dependabot[bot]
• 144: PSR-12 thanks to @t0mmy742
• 145: Add XOR to token to avoid BREACH attack thanks to @t0mmy742
• 146: Update phpspec/prophecy requirement from ^1.14 to ^1.15 thanks to @dependabot[bot]
• 147: Drop Support for PHP 7.3 thanks to @nbayramberdiyev
• 162: Update squizlabs/php_codesniffer requirement from ^3.6 to ^3.7 thanks to @dependabot[bot]
• 165: Bug fix: Enforce storage limit on failure thanks to @akrabat

• Added: Support for PSR-12
• Added: Add XOR to token to avoid BREACH attack
• Change: PHP 7.3 is no longer supported

This release makes using an Interator for the backing storage much better.

Total issues resolved: 3

• 130: Update phpunit/phpunit requirement from ^9.0 to ^9.5 thanks to @dependabot-preview[bot]
• 131: Update phpspec/prophecy requirement from ^1.10 to ^1.12 thanks to @dependabot-preview[bot]
• 132: Implement iterator support at getLastKeyPair thanks to @cwreden

• Added: Implement iterator support for getLastKeyPair

Total issues resolved: 1

• 129: Support PHP 8 and remove 7.1 and 7.2 thanks to @akrabat

• Added: Support PHP 8
• Changed: Remove support for PHP 7.1 and 7.2

Note that this release includes a fix for replay attacks when using Slim-Csrf in non-persistent mode. Upgrading to this version is recommended.

Total issues resolved: 10

• 108: Minor code comment correction thanks to @iamrameffort
• 112: Update .travis.yml thanks to @sergiy-petrov
• 115: Make remoteTokenFromStorage method public thanks to @l0gicgate
• 116: Minor improvements in code complexity with early returns and early validation thanks to @Ayesh
• 119: Update phpspec/prophecy requirement from ^1.8 to ^1.10 thanks to @dependabot-preview[bot]
• 120: Update squizlabs/php_codesniffer requirement from ^3.4.2 to ^3.5.5 thanks to @dependabot-preview[bot]
• 122: Update squizlabs/php_codesniffer requirement from ^3.5.5 to ^3.5.6 thanks to @dependabot-preview[bot]
• 123: Update squizlabs/php_codesniffer requirement from ^3.5.6 to ^3.5.8 thanks to @dependabot-preview[bot]
• 126: Remove token on validation to prevent replay attacks thanks to @akrabat
• 127: Raise error if there is a token in the body of a GET request thanks to @akrabat

• Changed: remoteTokenFromStorage() is now public
• Changed: Don't allow token in the body of a GET request
• Fixed: Prevent replay attack by removing token on valdiation

Total issues resolved: 1

• 105: PSR-15 Support thanks to @l0gicgate

• Added: PSR-15 support

Total issues resolved: 1

• 87: Widen random_compat constraint to include versions 9.99.X thanks to @ethanbray

• Fixed: Widen random_compat constraint in composer.json

Total issues resolved: 3

• 68: just adding sixth constructor param to phpdoc
• 70: Fix for Twig extension example
• 77: Attach token name and value to request when persist mode is on

• Fixed: Attach token name and value to request when persist mode is on

• Fixed: Default stroageis now $_SESSION again

• Added: Now supports "persistence mode", to persist a single CSRF name/value pair throughout the life of a user's session. Added the following methods:

  • protected getLastKeyPair - gets the most recently generated key/value pair from storage.
  • protected loadLastKeyPair - gets the most recently generated key/value pair from storage, and assign it to $this->keyPair.
  • public setPersistentTokenMode
  • public getPersistentTokenMode

  Note that if CSRF token validation fails, then the token should be renewed regardless of the persistence setting.

  The methods getTokenName and getTokenValue now return null if $this->keyPair has not yet been set.