{"action":"created","issue":{"url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/160","labels_url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/160/labels{/name}","comments_url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/160/comments","events_url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/160/events","html_url":"https://github.com/simple-mvc-framework/framework/pull/160","id":94913289,"number":160,"title":"Update Csrf.php & Create Request.php","user":{"login":"OmarElGabry","id":9262504,"avatar_url":"https://avatars.githubusercontent.com/u/9262504?v=3","gravatar_id":"","url":"https://api.github.com/users/OmarElGabry","html_url":"https://github.com/OmarElGabry","followers_url":"https://api.github.com/users/OmarElGabry/followers","following_url":"https://api.github.com/users/OmarElGabry/following{/other_user}","gists_url":"https://api.github.com/users/OmarElGabry/gists{/gist_id}","starred_url":"https://api.github.com/users/OmarElGabry/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OmarElGabry/subscriptions","organizations_url":"https://api.github.com/users/OmarElGabry/orgs","repos_url":"https://api.github.com/users/OmarElGabry/repos","events_url":"https://api.github.com/users/OmarElGabry/events{/privacy}","received_events_url":"https://api.github.com/users/OmarElGabry/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-07-14T10:18:31Z","updated_at":"2015-07-18T19:32:00Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/simple-mvc-framework/framework/pulls/160","html_url":"https://github.com/simple-mvc-framework/framework/pull/160","diff_url":"https://github.com/simple-mvc-framework/framework/pull/160.diff","patch_url":"https://github.com/simple-mvc-framework/framework/pull/160.patch"},"body":"The current implementation of CSRF tokens can be enhanced:\r\n\r\n1 . The current implementation is per-form; means if you have multiple opened pages from your website, and each page has a form, you will ending up having different tokens in each form.\r\n\r\n+ This could result in invalid CSRF token while the form is submitted from legitimate user(not faked).\r\n**Please** check this [thread](http://stackoverflow.com/questions/10466241/new-csrf-token-per-request-or-not?lq=1) \r\n+ Adding expiry date is better for making it more secured.\r\n\r\n2 . It's painful to re-write the following snippet in every view page.\r\n```php\r\n    use Helpers\\Session;\r\n    $token = trim($data['token']);\r\n    Session::set('token', $token);\r\n```\r\nInstead this should work \r\n```\r\n    <input type=\"hidden\" name=\"csrf_token\" value=\"<?= $data['csrf_token']; ?>\" />\r\n```\r\n\r\n3 . As well, validating the CSRF token could be encapsulated in a method. You may want to validate if the HTTP Method is POST before calling this method.\r\n```php\r\n    if (!Csrf::isTokenValid()) {\r\n    }\r\n```"},"comment":{"url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/comments/122586513","html_url":"https://github.com/simple-mvc-framework/framework/pull/160#issuecomment-122586513","issue_url":"https://api.github.com/repos/simple-mvc-framework/framework/issues/160","id":122586513,"user":{"login":"jimgwhit","id":7936192,"avatar_url":"https://avatars.githubusercontent.com/u/7936192?v=3","gravatar_id":"","url":"https://api.github.com/users/jimgwhit","html_url":"https://github.com/jimgwhit","followers_url":"https://api.github.com/users/jimgwhit/followers","following_url":"https://api.github.com/users/jimgwhit/following{/other_user}","gists_url":"https://api.github.com/users/jimgwhit/gists{/gist_id}","starred_url":"https://api.github.com/users/jimgwhit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimgwhit/subscriptions","organizations_url":"https://api.github.com/users/jimgwhit/orgs","repos_url":"https://api.github.com/users/jimgwhit/repos","events_url":"https://api.github.com/users/jimgwhit/events{/privacy}","received_events_url":"https://api.github.com/users/jimgwhit/received_events","type":"User","site_admin":false},"created_at":"2015-07-18T19:31:59Z","updated_at":"2015-07-18T19:31:59Z","body":"P.S. Normally a class does something to the data, I.e.,  filters, sanitizes, something you are basically sending foo to the class and returning foo exactly as is no changes no checking no difference. To me a class should have some purpose. I do not want simple MVC to turn into a monster like Laravel, for specialized classes I feel people should write their own and not add it to a framework like my clean sanitize class above, I did not put in a pull request on that. Let's keep this framework simple and not bogged down with a bunch of stuff. However I am all for your class if it had basic sanitizing but let the user choose what to sanitize and how to sanitize it, by having different filtering and/or sanitizing methods in the class."}}