{"id":191,"date":"2024-03-28T10:04:41","date_gmt":"2024-03-28T10:04:41","guid":{"rendered":"http:\/\/localhost\/w643\/?p=191"},"modified":"2024-03-28T10:34:54","modified_gmt":"2024-03-28T10:34:54","slug":"bai-10-csrf-protection","status":"publish","type":"post","link":"https:\/\/blog.hnk90.com\/?p=191","title":{"rendered":"B\u00e0i 10. CSRF Protection"},"content":{"rendered":"\n<p>Laravle cung c\u1ea5p CSRF Protection \u0111\u1ec3 g\u00fap h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt, an to\u00e0n h\u01a1n tr\u01b0\u1edbc c\u00e1c cu\u1ed9c t\u1ea7n c\u00f4ng cross-site (C\u00e1c b\u1ea1n c\u00f3 th\u1ec3 t\u00ecm hi\u1ec3u c\u00e1ch th\u1ee9c t\u1ea5n c\u00f4ng n\u00e0y tr\u00ean google nh\u00e9).<\/p>\n\n\n\n<p>Ho\u1eb7c hi\u1ec3u s\u01a1 qua v\u00ed d\u1ee5 tr\u00ean Doc: https:\/\/laravel.com\/docs\/10.x\/csrf<\/p>\n\n\n\n<p>V\u00ed d\u1ee5 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n c\u00f3 route &#8216;user\/email&#8217; &#8211; \u0111\u1ea1i kh\u00e1i th\u00ec route n\u00e0y l\u00e0m nhi\u1ec7m v\u1ee5 change email c\u1ee7a ng\u01b0\u1eddi d\u00f9ng (V\u1edbi ph\u01b0\u01a1ng th\u1ee9c POST ch\u1eb3ng h\u1ea1n)<br>Ng\u01b0\u1eddi d\u00f9ng \u0111ang \u1edf tr\u1ea1ng th\u00e1i \u0111\u0103ng nh\u1eadp tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n.<br>L\u00fac n\u00e0y, gi\u1ea3 s\u1eed Hackers n\u00f3 c\u00f3 m\u1ed9t site gi\u1ea3 m\u1ea1o n\u00e0o  (V\u00ed d\u1ee5 n\u00f3 l\u1eeba ng\u01b0\u1eddi v\u00e0o trang web abc.com n\u00e0o \u0111\u00f3 r\u1ed3i \u0111i\u1ec1n email tr\u00fang th\u01b0\u1edfng ch\u1eb3ng h\u1ea1n)<br>L\u00fac n\u00e0y n\u00f3 s\u1ebd h\u01b0\u1edbng request v\u1ec1 route &#8216;user\/email&#8217; tr\u00ean h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n v\u00e0 khi\u1ebfn email c\u1ee7a b\u1ea1n b\u1ecb thay \u0111\u1ed5i. <\/p>\n\n\n\n<p>V\u1eady n\u00ean Laravel cung c\u1ea5p c\u01a1 ch\u1ebf CSRF protection (v\u1edbi c\u00e1c method POST, PUT, PATCH, DELETE) \u0111\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng cross-site nh\u01b0 v\u1eady.<\/p>\n\n\n\n<p>Trong c\u00e1c form html th\u00ec b\u1ea1n lu\u00f4n lu\u00f4n nh\u1edb th\u00eam @csrf, v\u00ed d\u1ee5 <\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-code=\"&lt;form method=&quot;POST&quot; action=&quot;\/profile&quot;&gt;\n    @csrf\n \n    &lt;!-- Equivalent to... --&gt;\n    &lt;input type=&quot;hidden&quot; name=&quot;_token&quot; value=&quot;{{ csrf_token() }}&quot; \/&gt;\n&lt;\/form&gt;\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #81A1C1\">&lt;form<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">method<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">POST<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">action<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">\/profile<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #81A1C1\">&gt;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    @csrf<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    &lt;!-- Equivalent to... --&gt;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">&lt;input<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">type<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">hidden<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">name<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">_token<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #8FBCBB\">value<\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">{{ csrf_token() }}<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">\/&gt;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">&lt;\/form&gt;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>B\u1ea3n th\u00e2n v\u1edbi m\u1ed7i session c\u1ee7a user lu\u00f4n c\u00f3 m\u1ed9t token, n\u00f3 \u0111\u01b0\u1ee3c d\u00f9ng \u0111\u1ec3 ch\u1ee9ng th\u1ef1c ng\u01b0\u1eddi d\u00f9ng.  B\u1ea1n c\u00f3 th\u1ec3 g\u1ecdi ra nh\u01b0 sau <\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-code=\"use Illuminate\\Http\\Request;\n \nRoute::get('\/token', function (Request $request) {\n    $token = $request-&gt;session()-&gt;token();\n \n    $token = csrf_token();\n \n    \/\/ ...\n});\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #D8DEE9\">use<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #D8DEE9\">Illuminate<\/span><span style=\"color: #D8DEE9FF\">\\<\/span><span style=\"color: #D8DEE9\">Http<\/span><span style=\"color: #D8DEE9FF\">\\<\/span><span style=\"color: #D8DEE9\">Request<\/span><span style=\"color: #81A1C1\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">Route<\/span><span style=\"color: #ECEFF4\">:<\/span><span style=\"color: #D8DEE9FF\">:<\/span><span style=\"color: #88C0D0\">get<\/span><span style=\"color: #D8DEE9FF\">(<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #A3BE8C\">\/token<\/span><span style=\"color: #ECEFF4\">&#39;<\/span><span style=\"color: #ECEFF4\">,<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">function<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #D8DEE9\">Request<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #D8DEE9\">$request<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #D8DEE9\">$token<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #D8DEE9\">$request<\/span><span style=\"color: #81A1C1\">-&gt;<\/span><span style=\"color: #88C0D0\">session<\/span><span style=\"color: #D8DEE9FF\">()<\/span><span style=\"color: #81A1C1\">-&gt;<\/span><span style=\"color: #88C0D0\">token<\/span><span style=\"color: #D8DEE9FF\">()<\/span><span style=\"color: #81A1C1\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #D8DEE9\">$token<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">csrf_token<\/span><span style=\"color: #D8DEE9FF\">()<\/span><span style=\"color: #81A1C1\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">    <\/span><span style=\"color: #616E88\">\/\/ ...<\/span><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">}<\/span><span style=\"color: #D8DEE9FF\">)<\/span><span style=\"color: #81A1C1\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Oke, ki\u1ebfn th\u1ee9c n\u00e0y ch\u1ec9 t\u1edbi \u0111\u00e2y l\u00e0 \u0111\u1ee7. Ch\u00fang ta s\u1ebd b\u00e0n s\u00e2u h\u01a1n khi \u0111i v\u00e0o d\u1ef1 \u00e1n c\u1ee5 th\u1ec3 c\u00e1c b\u1ea1n nh\u00e9. <\/p>\n\n\n\n<p>Next one, h\u1eb9n g\u1eb7p l\u1ea1i t\u1ea1i b\u00e0i h\u1ecdc: Controller \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Laravle cung c\u1ea5p CSRF Protection \u0111\u1ec3 g\u00fap h\u1ec7 th\u1ed1ng b\u1ea3o m\u1eadt, an to\u00e0n h\u01a1n tr\u01b0\u1edbc c\u00e1c cu\u1ed9c t\u1ea7n c\u00f4ng cross-site (C\u00e1c b\u1ea1n c\u00f3 th\u1ec3 t\u00ecm hi\u1ec3u c\u00e1ch th\u1ee9c t\u1ea5n c\u00f4ng n\u00e0y tr\u00ean google nh\u00e9). Ho\u1eb7c hi\u1ec3u s\u01a1 qua v\u00ed d\u1ee5 tr\u00ean Doc: https:\/\/laravel.com\/docs\/10.x\/csrf V\u00ed d\u1ee5 h\u1ec7 th\u1ed1ng c\u1ee7a b\u1ea1n c\u00f3 route &#8216;user\/email&#8217; &#8211; \u0111\u1ea1i kh\u00e1i [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-191","post","type-post","status-publish","format-standard","hentry","category-laravel"],"_links":{"self":[{"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/posts\/191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=191"}],"version-history":[{"count":3,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/posts\/191\/revisions"}],"predecessor-version":[{"id":194,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=\/wp\/v2\/posts\/191\/revisions\/194"}],"wp:attachment":[{"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.hnk90.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}