PHPackages                             ocramius/psr7-csrf - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. ocramius/psr7-csrf

Abandoned → [psr7-sessions/storageless](/?search=psr7-sessions%2Fstorageless)ArchivedLibrary[Utility & Helpers](/categories/utility)

ocramius/psr7-csrf
==================

2.0.0(8y ago)1851.9k3MITPHPPHP ^7.1.0

Since Mar 20Pushed 8y ago1 watchersCompare

[ Source](https://github.com/Ocramius/PSR7Csrf)[ Packagist](https://packagist.org/packages/ocramius/psr7-csrf)[ RSS](/packages/ocramius-psr7-csrf/feed)WikiDiscussions master Synced 5d ago

READMEChangelog (5)Dependencies (8)Versions (8)Used By (0)

PSR-7 Storage-less HTTP CSRF protection
=======================================

[](#psr-7-storage-less-http-csrf-protection)

[![Build Status](https://camo.githubusercontent.com/889b426e80a1d2c91b7fdd669346d8fa9ff65c169a6a43d9b9121ef565a31448/68747470733a2f2f7472617669732d63692e6f72672f4f6372616d6975732f50535237437372662e737667)](https://travis-ci.org/Ocramius/PSR7Csrf)[![Scrutinizer Code Quality](https://camo.githubusercontent.com/e106032977fd44f6f5a7e32962a0d7496ea0f294547c304fb08ba13af4b6e985/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f4f6372616d6975732f50535237437372662f6261646765732f7175616c6974792d73636f72652e706e673f623d6d6173746572)](https://scrutinizer-ci.com/g/Ocramius/PSR7Csrf/?branch=master)[![Code Coverage](https://camo.githubusercontent.com/b8167ff4fd79c9dae64c5a9077054cc44aa7efcbb24d89be2e2b1e3074996c53/68747470733a2f2f7363727574696e697a65722d63692e636f6d2f672f4f6372616d6975732f50535237437372662f6261646765732f636f7665726167652e706e673f623d6d6173746572)](https://scrutinizer-ci.com/g/Ocramius/PSR7Csrf/?branch=master)[![Packagist](https://camo.githubusercontent.com/c4d91b43e5b5c4e1177462bf855521147a61049000ad8619bb5df3e79a17228a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6f6372616d6975732f707372372d637372662e737667)](https://packagist.org/packages/ocramius/psr7-csrf)[![Packagist](https://camo.githubusercontent.com/0ad06a722919d797266f779886a8935f49e97f4a64865d52e7520fca1aaee62b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f767072652f6f6372616d6975732f707372372d637372662e737667)](https://packagist.org/packages/ocramius/psr7-csrf)

**PSR7Csrf** is a [PSR-7](http://www.php-fig.org/psr/psr-7/)[middleware](https://mwop.net/blog/2015-01-08-on-http-middleware-and-psr-7.html) that enables [CSRF](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)) protection for PSR-7 based applications.

DEPRECATED in favor of `psr7-sessions/storageless` 5.0.0+
=========================================================

[](#deprecated-in-favor-of-psr7-sessionsstorageless-500)

Please note that this package is **DEPRECATED**.

Since [`psr7-sessions/storageless` 5.0.0](https://github.com/psr7-sessions/storageless/releases/tag/5.0.0), the generated cookies are CSRF-resistant by default for unsafe HTTP methods (`POST`/`PUT`/`DELETE`/`PATCH`/etc.), so the usage of this package is no longer needed. You can still install `ocramius/psr7-csrf`, but since there is no practical need for it, it is not necessary to do so.

### What is this about?

[](#what-is-this-about)

Instead of storing tokens in the session, PSR7Csrf simply uses JWT tokens, which can be verified, signed and have a specific lifetime on their own.

This storage-less approach prevents having to load tokens from a session or from a database, and simplifies the entire UI workflow: tokens are valid as long as their signature and expiration date holds.

### Installation

[](#installation)

```
composer require ocramius/psr7-csrf
```

### Usage

[](#usage)

The simplest usage is based on defaults. It assumes that you have a configured PSR-7 compatible application that supports piping middlewares, and it also requires you to run [PSR7Session](https://github.com/Ocramius/PSR7Session).

In a [`zendframework/zend-expressive`](https://github.com/zendframework/zend-expressive)application, the setup would look like the following:

```
$app = \Zend\Expressive\AppFactory::create();

$app->pipe(\PSR7Session\Http\SessionMiddleware::fromSymmetricKeyDefaults(
    'mBC5v1sOKVvbdEitdSBenu59nfNfhwkedkJVNabosTw=', // replace this with a key of your own (see PSR7Session docs)
    1200 // 20 minutes session duration
));

$app->pipe(\PSR7Csrf\Factory::createDefaultCSRFCheckerMiddleware());
```

This setup will require that any requests that are not `GET`, `HEAD` or `OPTIONS` contain a `csrf_token` in the request body parameters (JSON or URL-encoded).

You can generate the CSRF token for any form like following:

```
$tokenGenerator = \PSR7Csrf\Factory::createDefaultTokenGenerator();

$app->get('/get', function ($request, $response) use ($tokenGenerator) {
    $response
        ->getBody()
        ->write(
            ''
            . ''
            . ''
            . ''
        );

    return $response;
});

$app->post('/post', function ($request, $response) {
    $response
        ->getBody()
        ->write('It works!');

    return $response;
});
```

### Examples

[](#examples)

```
composer install # install at the root of this package first!
cd examples
composer install
php -S localhost:9999 index.php
```

Then try accessing `http://localhost:9999`: you should see a simple submission form.

If you try modifying the submitted CSRF token (which is in a hidden form field), then the `POST` request will fail.

### Known limitations

[](#known-limitations)

Please refer to the [known limitations of PSR7Session](https://github.com/Ocramius/PSR7Session/blob/master/docs/limitations.md).

Also, this component does *NOT* prevent double-form-submissions: it merely prevents CSRF attacks from third parties. As long as the CSRF token is valid, it can be reused over multiple requests.

### Contributing

[](#contributing)

Please refer to the [contributing notes](CONTRIBUTING.md).

### License

[](#license)

This project is made public under the [MIT LICENSE](LICENSE).

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity31

Limited adoption so far

Community16

Small or concentrated contributor base

Maturity63

Established project with proven stability

 Bus Factor1

Top contributor holds 93.1% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~113 days

Recently: every ~170 days

Total

7

Last Release

3120d ago

Major Versions

1.0.x-dev → 2.0.02018-01-28

PHP version history (2 changes)1.0.0-ALPHA1PHP ~7.0

2.0.0PHP ^7.1.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/fd0445bc21fa116c259b5889377b90cbd8a34d49357321f76a74f6d2c2ae6b0c?d=identicon)[Ocramius](/maintainers/Ocramius)

---

Top Contributors

[![Ocramius](https://avatars.githubusercontent.com/u/154256?v=4)](https://github.com/Ocramius "Ocramius (394 commits)")[![lcobucci](https://avatars.githubusercontent.com/u/201963?v=4)](https://github.com/lcobucci "lcobucci (12 commits)")[![AndrewCarterUK](https://avatars.githubusercontent.com/u/6486835?v=4)](https://github.com/AndrewCarterUK "AndrewCarterUK (10 commits)")[![samsonasik](https://avatars.githubusercontent.com/u/459648?v=4)](https://github.com/samsonasik "samsonasik (3 commits)")[![danizord](https://avatars.githubusercontent.com/u/1850941?v=4)](https://github.com/danizord "danizord (2 commits)")[![jonathantorres](https://avatars.githubusercontent.com/u/195615?v=4)](https://github.com/jonathantorres "jonathantorres (1 commits)")[![stof](https://avatars.githubusercontent.com/u/439401?v=4)](https://github.com/stof "stof (1 commits)")

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/ocramius-psr7-csrf/health.svg)

```
[![Health](https://phpackages.com/badges/ocramius-psr7-csrf/health.svg)](https://phpackages.com/packages/ocramius-psr7-csrf)
```

###  Alternatives

[cakephp/cakephp

The CakePHP framework

8.9k20.0M1.8k](/packages/cakephp-cakephp)[mcp/sdk

Model Context Protocol SDK for Client and Server applications in PHP

1.6k2.2M138](/packages/mcp-sdk)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[cakephp/authentication

Authentication plugin for CakePHP

1214.3M118](/packages/cakephp-authentication)[typo3/cms-core

TYPO3 CMS Core

3313.6M5.6k](/packages/typo3-cms-core)[xima/xima-typo3-frontend-edit

Frontend Edit - This extension provides an edit button for editors within frontend content elements.

1615.6k](/packages/xima-xima-typo3-frontend-edit)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)