PHPackages                             gokhankurtulus/csrf - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. gokhankurtulus/csrf

ActiveLibrary[Security](/categories/security)

gokhankurtulus/csrf
===================

A simple PHP CSRF class that provides functionality for operating CSRF tokens.

1.0.0(3y ago)017MITPHPPHP ^7.1 || ^8.0

Since Jun 18Pushed 3y ago1 watchersCompare

[ Source](https://github.com/gokhankurtulus/csrf)[ Packagist](https://packagist.org/packages/gokhankurtulus/csrf)[ RSS](/packages/gokhankurtulus-csrf/feed)WikiDiscussions main Synced 2w ago

READMEChangelog (1)DependenciesVersions (2)Used By (0)

Csrf
====

[](#csrf)

[![License: MIT](https://camo.githubusercontent.com/08cef40a9105b6526ca22088bc514fbfdbc9aac1ddbf8d4e6c750e3a88a44dca/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d626c75652e737667)](LICENSE)[![PHP Version](https://camo.githubusercontent.com/f280639774f89848543f01ec4b6a6d2c5c5a3f6d42a320581f9e1387a647f56e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d372e312532422d626c75652e737667)](https://camo.githubusercontent.com/f280639774f89848543f01ec4b6a6d2c5c5a3f6d42a320581f9e1387a647f56e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d372e312532422d626c75652e737667)[![Release](https://camo.githubusercontent.com/a3058b31d783eb728e61107c8fde99bdcf971331462fa877aaac5f62759bd0a9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f676f6b68616e6b757274756c75732f637372662e737667)](https://camo.githubusercontent.com/a3058b31d783eb728e61107c8fde99bdcf971331462fa877aaac5f62759bd0a9/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f762f72656c656173652f676f6b68616e6b757274756c75732f637372662e737667)

A simple PHP CSRF class that provides functionality for operating CSRF tokens.

Installation
------------

[](#installation)

You can install the Csrf class using [Composer](https://getcomposer.org/). Run the following command in your project's root directory:

```
composer require gokhankurtulus/csrf
```

Usage
-----

[](#usage)

To use the Csrf class in your PHP script, you need to include the Composer autoloader:

```
require_once 'vendor/autoload.php';
```

### Creating a New Token

[](#creating-a-new-token)

You can generate a new CSRF token using the `newToken` method. The method accepts two parameters: the token name and an optional expiry time in seconds (default is 600 seconds = 10 minutes).

```
use Csrf\Csrf;

$token = Csrf::newToken('my_token', 1200); // Generate a token named 'my_token' that expires in 20 minutes
```

The `newToken` method returns a `stdClass` object containing the token information. The object has the following properties:

- `name`: The name of the token.
- `expiry`: The expiry timestamp of the token.
- `value`: The token value.

### Getting a Token

[](#getting-a-token)

To retrieve a previously generated token, you can use the `getToken` method. It accepts the token name as a parameter and returns the token object if found, or `null` if the token does not exist.

```
$token = Csrf::getToken('my_token'); // Get the token object for 'my_token'
```

### Creating an HTML Input Field

[](#creating-an-html-input-field)

The `createInput` method generates an HTML input field with the CSRF token embedded. It accepts the token name and an optional expiry time (default is 600 seconds or 10 minutes) as parameters. The method returns the HTML input field as a string or `null` if the session is not started or the token name is empty.

```
$input = Csrf::createInput('my_token', 1800); // Generate an HTML input field for 'my_token' that expires in 30 minutes
echo $input; // Output the HTML input field
```

The generated HTML input field can be used in forms to send the CSRF token value along with other form data.

### Verifying a Token

[](#verifying-a-token)

To verify if a submitted token is valid, you can use the `verify` method. It accepts the token name, an optional parameter to unset the token if it is verified (default is `false`), and the token value submitted with the request (can be retrieved from the `$_POST` superglobal by default).

```
$isVerified = Csrf::verify('my_token', true); // Verify the submitted token for 'my_token' and unset it if verified
if ($isVerified) {
    // Token is valid
} else {
    // Token is invalid
}
```

The `verify` method returns a boolean value indicating whether the token is valid or not.

### Unsetting a Token

[](#unsetting-a-token)

To unset a token manually, you can use the `unsetToken` method. It accepts the token name as a parameter and returns `true` if the token is successfully unset or `false` if the session is not started or the token name is empty.

```
Csrf::unsetToken('my_token'); // Unset the token named 'my_token'
```

Session Status
--------------

[](#session-status)

The Csrf class relies on PHP sessions to store and retrieve CSRF tokens. The `isSessionStarted` method can be used to check if a session is already started.

```
$isSessionStarted = Csrf::isSessionStarted();

// Check if a session is started
if ($isSessionStarted) {
    // Session is active
} else {
    // Session is not active
}
```

License
-------

[](#license)

Csrf is open-source software released under the [MIT License](LICENSE). Feel free to modify and use it in your projects.

Contributions
-------------

[](#contributions)

Contributions to Csrf are welcome! If you find any issues or have suggestions for improvements, please create an issue or submit a pull request on the [GitHub repository](https://github.com/gokhankurtulus/csrf).

###  Health Score

23

—

LowBetter than 25% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity6

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity50

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

1156d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/43145716?v=4)[Gökhan Kurtuluş](/maintainers/gokhankurtulus)[@gokhankurtulus](https://github.com/gokhankurtulus)

---

Top Contributors

[![gokhankurtulus](https://avatars.githubusercontent.com/u/43145716?v=4)](https://github.com/gokhankurtulus "gokhankurtulus (1 commits)")

---

Tags

csrfphpcsrf

### Embed Badge

![Health badge](/badges/gokhankurtulus-csrf/health.svg)

```
[![Health](https://phpackages.com/badges/gokhankurtulus-csrf/health.svg)](https://phpackages.com/packages/gokhankurtulus-csrf)
```

###  Alternatives

[aura/session

Provides session management functionality, including lazy session starting, session segments, next-request-only ("flash") values, and CSRF tools.

2061.3M80](/packages/aura-session)[paragonie/anti-csrf

Paragon Initiative's Anti-CSRF Security Library

307220.3k5](/packages/paragonie-anti-csrf)[owasp/csrf-protector-php

CSRF protector php, a standalone php library for csrf mitigation in web applications. Easy to integrate in any php web app.

215377.3k6](/packages/owasp-csrf-protector-php)[kunststube/csrfp

A signed token generator for cross site request forgery protection.

52212.2k1](/packages/kunststube-csrfp)[riimu/kit-csrf

Secure and simple CSRF library protected against timing and BREACH attacks

6527.7k](/packages/riimu-kit-csrf)[ayesh/stateless-csrf

Secret-key based state-less CSRF token generator and validator for PHP 8. State-less means you do not have to store the CSRF token in session or database.

3225.0k](/packages/ayesh-stateless-csrf)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)