时间戳

首页 > 解决方案 > If We Validate User Is Logged In or Not, Do We Still Need To Use FORM Tokens To Avoid CSRF Attacks?

php - If We Validate User Is Logged In or Not, Do We Still Need To Use FORM Tokens To Avoid CSRF Attacks?

问题描述

Let's assume when a form is submitted, a request is sent to FormToDatabase.php

FormToDatabase.php verifies if the user is logged in or not using

if(!isset($_SESSION['user'])){
echo 'Log In First';
die();
}

When it comes to CSRF, the attacker won't be able to send the request because the user needs to be logged in.

So, is it necessary to use form/link tokens for extra security or not?

标签： php

解决方案

推荐阅读