How to deal with CSRF (I think)?

Question

For example, in admin cp, to delete a user, there is a link - http://example.com/acp/delete-user.php?id=102 . When the link is open, the system automatically removes this user from the database. Imagine that someone sent me a link (like this), and I accidentally opened it. This means that I am deleting this user without knowing it. = (How to handle this? POST method? Some tokens? And how to do it for sure. I'm just learning. = P

Answer 1

I recommend that you do these things with FORM. http://example.com/acp/delete-user.php?id=102 show the form using the DELETE and HIDEN INPUT buttons with a randomly generated key. The value is stored in a server-side session. When you click submit, the landing page will check if you have passed the correct key.

There are many resources on the network about CSRF.

Answer 2

You have viewed this article . As others have said, I hope you have authentication in everything. But for the correct implementation, you will need to perform a token service. Because if you are logged in and I will send you a link, it will delete the user.

Answer 3

POST ( , POST).

( ). - , . , .

: http://www.serversidemagazine.com/php/php-security-measures-against-csrf-attacks

Answer 4

, , , , .