Forms and CSRF protection #

This page is for developers used to Symfony Form types, Laravel form requests, Django forms or Rails form helpers. Exponential has no form component that builds, binds and validates a form object. A form is HTML in a template; the view reads the posted values through the kernel's helpers and module actions; and the ezformtoken extension protects POST requests against cross-site request forgery without code in your forms.

Contents #

1. The parts of a form
2. CSRF protection with ezformtoken
3. Reading input
4. POST, redirect, GET
5. Uploads
6. Forms for visitors
7. Compared with other frameworks

The parts of a form #

A worked form is in Task: build a small CRUD module.

CSRF protection with ezformtoken #

ezformtoken registers two listeners (Middleware):

• response/output: adds a hidden token field to every method="post" form in the page for a signed-in user with a session. Your templates need nothing.
• request/input: refuses a POST of such a user without the right token, taken from the form field or from the X-CSRF-Token header. The answer is a 403 "This form has expired" page (or a JSON body for XHR and JSON requests) and one line in var/log/warning.log, never the token itself (Form expired page).

Set your own secret per installation in settings/override/site.ini.append.php:

[HTMLForms]
Secret=<a long random value of your own>

JavaScript that posts with fetch() sends the token in the X-CSRF-Token header; read it from the page rather than switching the check off (Forms, CSRF protection and HTTP input).

Anonymous visitors have no session to bind a token to, so their POSTs are not checked by ezformtoken. Public forms are protected with other means: a CAPTCHA from the recaptcha or hcaptcha extension and server-side validation (Spam protection for forms).

Reading input #

$http = eZHTTPTool::instance();
if ( $http->hasPostVariable( 'Title' ) )
    $title = trim( (string)$http->postVariable( 'Title' ) );
$page = $http->hasGetVariable( 'page' ) ? max( 1, (int)$http->getVariable( 'page' ) ) : 1;

Never read $_POST or $_GET directly: under Velocity the kernel prepares them per request.

POST, redirect, GET #

if ( $Module->isCurrentAction( 'Store' ) && $errors === array() )
{
    $item->store();
    return $Module->redirectTo( '/expdemo/item/' . (int)$item->attribute( 'id' ) );
}

Redirect targets taken from the request must stay on the site (Safe redirects).

Uploads #

if ( eZHTTPFile::canFetch( 'File' ) )
{
    $file = eZHTTPFile::fetch( 'File' );
    // check $file->attribute( 'mime_type' ) and size against an allow list before storing
}

For files that belong to content, create an object of the file or image class instead; it handles storage, clustering and SVG sanitizing (Creating and updating content in code).

Forms for visitors #

Contact forms, polls and feedback usually need no PHP: a content class with information collector attributes collects the answers, and the administration lists them (Forms with the information collector, Building a contact form).

Compared with other frameworks #

Related pages #

• Forms, CSRF protection and HTTP input
• Forms in templates
• Responses, redirects, errors and JSON
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.