paragonie / anti-csrf

Full-Featured Anti-CSRF Library
https://paragonie.com/projects
GNU Affero General Public License v3.0
297 stars 52 forks source link

Feature: can select 'PATH_INFO' as the locking mechanism #20

Closed acornforth closed 6 years ago

acornforth commented 7 years ago

for cases when REQUEST_URI is too specific for implementation to be feasible (query-string params) or in cases where query string params may/may not be present, and may not always hold same data. Suitable for use with 'front-controller' type uris

acornforth commented 7 years ago

Hi, I apologise if i haven't followed the usual ettiquette for making pull requests, by not contacting you in the first instance about my feature. As it happens this modifiaction was essential for a project i'm working on, so I currently have composer loading this module from my forked repo... I appreciate that dispensing with the QueryString when checking the lock makes this slightly less secure, and so the original behaviour remains the default. However there are situations when locking to the entire URI is not appropriate, so I am sure other users may find this useful. Regards Andrew