Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git:
All I see on Git however is *.java files and *.js files. If there are PHP files where in the directory structure are they?
phpBB prevents CSRF by adding two hidden parameters to all forms. The time and a SHA1 hash of the time, a per-user "form salt", the session identifier and the form name. Source:
My question is... why is anything other than the form salt necessary? To prevent CSRF all you need is a random string that an attacker can't predict so that they can't send an HTTP request blind and the form salt would do the trick it seems to me. Hashing that together with everything else just seems unnecessary.
Maybe their motivation is that the form salt could be compromised if someone copy / pasted the HTML contents of the page? Maybe it's intended to future proof it? An XSS vulnerability would permanently compromise the CSRF protections if the form salt was used directly whereas with a hash of time and the form salt protects against that scenario.
Also, if the salt was just two characters or so I could understand doing the sha1() hash but a two character long salt is just insecure because all you need to do at that point is send 256**2 blind HTTP requests, each with a different token. But it's not two characters long either.