Help me understand tokens

Hey Filip.

Yes, I'm pretty sure I am. In my cookie file I can see two cookies (PHPSESSID & nette-browser)

#HttpOnly_xxxxxx	FALSE	/	FALSE	0	PHPSESSID	9q2mz256mcqnbr7b7unmrahng4
#HttpOnly_xxxxxx	FALSE	/	FALSE	0	nette-browser	d8efij8l9o

I know at least the SESSID is being carried to the second request as I appeared as logged in in the server's reply. I'm not sure what “nette-browser” is made for though, when using CURL it changes all the time.
Below both requests:

<?php
		// This is how I make the first request (in order to get the token)
		public function getpage($url = "")
		{

			if (!$url || empty($url)) return false;
			$ch = curl_init();
			curl_setopt($ch, CURLOPT_URL, $url);
			curl_setopt($ch, CURLOPT_HEADER, 0);
			curl_setopt($ch, CURLOPT_USERAGENT, $this->agent);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
			curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
			curl_setopt($ch, CURLOPT_REFERER, $this->referer);
			curl_setopt($ch, CURLOPT_COOKIEJAR, $this->cookie);
			curl_setopt($ch, CURLOPT_COOKIESESSION, true);
			curl_setopt($ch, CURLOPT_COOKIEFILE, $this->cookie);
			$a = curl_exec($ch);

			$info['status'] = curl_getinfo($ch, CURLINFO_HTTP_CODE);
			$info['time'] = curl_getinfo($ch, CURLINFO_TOTAL_TIME);
			$info['lenght'] = curl_getinfo($ch, CURLINFO_CONTENT_LENGTH_DOWNLOAD);

			curl_close($ch);

			if ($info['status'] != 200) { die("Connection error: {$info['status']}"); }
			return $a;
		}

		// This is how I send the form
		public function send_form($url, $data)
		{
			if (!$url || empty($url)) return false;
			$ch = curl_init();
			curl_setopt($ch, CURLOPT_URL, $url);
			curl_setopt($ch, CURLOPT_HEADER, 0);
			curl_setopt($ch, CURLOPT_POST, true);
			curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
			curl_setopt($ch, CURLOPT_USERAGENT, $this->agent);
			curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
			curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
			curl_setopt($ch, CURLOPT_USERAGENT, $this->agent);
			curl_setopt($ch, CURLOPT_COOKIEJAR, $this->cookie);
			curl_setopt($ch, CURLOPT_COOKIESESSION, true);
			curl_setopt($ch, CURLOPT_COOKIEFILE, $this->cookie);

			$a = curl_exec($ch);

			$info['status'] = curl_getinfo($ch, CURLINFO_HTTP_CODE);
			$info['time'] = curl_getinfo($ch, CURLINFO_TOTAL_TIME);
			$info['lenght'] = curl_getinfo($ch, CURLINFO_CONTENT_LENGTH_DOWNLOAD);

			if ($info['status'] != 200) { die("Connection error: {$info['status']} - ".curl_error($ch)); }

			curl_close($ch);

			return $a;
		}
?>

Jan, thank you for your response. I know they are not meant to protect you from spam but they help in most case as they require 2 connections while most spam bots will only handle 1. This is people wanting to spam a CSFR protected form will need to use twice as much bandwidth as they would with a “normal” form and I guess this stops quite a bit of spamming.

And, of course, the token is indeed in the $data array.

Could it maybe have something to do with the nette-browser cookie that keeps on getting updated ?

Last edited by MBP2013 (2013-11-25 12:20)