Where to check the link form and form token in an MVC application?

Question

I check all the data of my forms at the model level, but I also check where my form was sent (HTTP Referrer), and I also send the token with the form to prevent cross-site requests from being prevented, and my question is Where are these checks? In the controller or at the model level?

I came up with several different ways to do this, and one of them had to have some kind of protected method in my AbstractController to check the form source and the placed token, but then that could break SRP.

Answer 1

(..) where should these checks be performed? In the controller or at the model level?

None.

In my humble opinion, CSRF protection should be handled at the same level as other forms of access control: outside the MVC triad.

If the application cannot verify the token, this means that the data in the Request instance (or your alternative) cannot be trusted, so it must be disposed of. I would do such a check before initializing the Controller instance and / of View .

Answer 2

It is generally wise to check your data several times with different intentions. I suggest these levels:

1) Previously, the front controller checks the received data for integrity . If you missed some token or got some timeout in the browser, etc., you immediately exit. You do not allow these requests to reach your MVC. Here you may want suoshin . The reason is that deeper levels can associate protected data with the browser even if an error occurs. Imagine someone skipped a security token (attack?), And your submission returns an error message and sets some cookies. With their help, an attacker can log into the system after any invalid form request.

2) The front controller checks if the entered can be entered in this form from this user, etc. (for example, if the US User can enter the Canadian Phonenumber number). He should give direct feedback in the form "enter the correct phone number", etc.

3) The model checks if the data is in a state that should be safely stored and returned, for example. if it has been shielded, has the desired length, etc.