WEB-CSRF-01 & WEB-CONFIG-01 - CSRF and Misconfiguration

<!-- VULNERABLE: No CSRF protection -->
<form action="/transfer" method="POST">
  <input name="amount" value="1000">
  <input name="to" value="attacker-account">
  <input type="submit" value="Transfer">
</form>
<!-- Malicious site -->
<img src="https://bank.com/transfer?amount=1000&to=attacker">

<!-- SECURE: CSRF token implementation -->
<form action="/transfer" method="POST">
  <input type="hidden" name="csrf_token" value="<?php echo $csrf_token; ?>">
  <input name="amount" value="1000">
  <input name="to" value="recipient-account">
  <input type="submit" value="Transfer">
</form>
<!-- Server validation -->
if ($_POST['csrf_token'] !== $_SESSION['csrf_token']) {
  die('CSRF token mismatch');
}

<!-- SECURE: SameSite cookie -->
Set-Cookie: sessionid=abc123; SameSite=Strict; Secure; HttpOnly
<!-- SameSite values -->
SameSite=Strict    // Never sent with cross-site requests
SameSite=Lax       // Sent with top-level navigation
SameSite=None      // Always sent (requires Secure flag)

<!-- VULNERABLE: Default credentials -->
admin / admin
admin / password
root / root
guest / guest
<!-- SECURE: Strong credentials -->
admin / Kx9#mP2$vL8@nQ4
root / 7F&gH3*jK9#mN5$pR2

<!-- VULNERABLE: Debug mode in production -->
DEBUG = True
<!-- SECURE: Debug mode disabled -->
DEBUG = False

<!-- VULNERABLE: Directory traversal -->
<img src="<?php echo $_GET['file']; ?>">
<!-- Malicious request -->
GET /image.php?file=../../../etc/passwd
<!-- SECURE: Path validation -->
$file = basename($_GET['file']);
$path = '/safe/directory/' . $file;

<!-- VULNERABLE: Error messages -->
Error: Database connection failed: mysql://root:password@localhost/db
<!-- VULNERABLE: Version disclosure -->
Server: Apache/2.4.41 (Ubuntu)
X-Powered-By: PHP/7.4.3
<!-- SECURE: Generic error messages -->
Error: An error occurred. Please try again later.

<!-- SECURE: Double submit cookie -->
<script>
  function getCookie(name) {
    let value = "; " + document.cookie;
    let parts = value.split("; " + name + "=");
    if (parts.length == 2) return parts.pop().split(";").shift();
  }
  let csrfToken = getCookie('csrf_token');
  fetch('/api/transfer', {
    method: 'POST',
    headers: { 'X-CSRF-Token': csrfToken },
    body: JSON.stringify({amount: 100, to: 'account'})
  });
</script>

<!-- SECURE: Origin validation -->
if ($_SERVER['HTTP_ORIGIN'] !== 'https://trusted-domain.com') {
  http_response_code(403);
  die('Invalid origin');
}

<!-- SECURE: Environment configuration -->
# Production settings
DEBUG = False
SECRET_KEY = os.environ.get('SECRET_KEY')
DATABASE_URL = os.environ.get('DATABASE_URL')
ALLOWED_HOSTS = ['yourdomain.com']
# Development settings
DEBUG = True
SECRET_KEY = 'dev-key-only'
DATABASE_URL = 'sqlite:///dev.db'

<!-- SECURE: Security headers -->
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'

<!-- SECURE: Path validation -->
function validateFilePath($input) {
  // Remove directory traversal sequences
  $input = str_replace(['../', '..\\', '..\\\\'], '', $input);
  // Use basename to get only filename
  $filename = basename($input);
  // Validate against allowed files
  $allowedFiles = ['file1.txt', 'file2.pdf', 'image.jpg'];
  return in_array($filename, $allowedFiles);
}

<!-- SECURE: Generic error handling -->
try {
  $result = performOperation();
} catch (Exception $e) {
  // Log detailed error for debugging
  error_log($e->getMessage());
  // Show generic error to user
  echo "An error occurred. Please try again.";
}

<!-- SECURE: Password validation -->
function validatePassword($password) {
  if (strlen($password) < 12) return false;
  if (!preg_match('/[A-Z]/', $password)) return false;
  if (!preg_match('/[a-z]/', $password)) return false;
  if (!preg_match('/[0-9]/', $password)) return false;
  if (!preg_match('/[^A-Za-z0-9]/', $password)) return false;
  return true;
}

<!-- SECURE: Session configuration -->
session.cookie_httponly = 1
session.cookie_secure = 1
session.cookie_samesite = "Strict"
session.use_strict_mode = 1
session.gc_maxlifetime = 1800  // 30 minutes

<!-- SECURE: Security logging -->
function logSecurityEvent($event, $details) {
  $logEntry = [
    'timestamp' => date('Y-m-d H:i:s'),
    'event' => $event,
    'ip' => $_SERVER['REMOTE_ADDR'],
    'user_agent' => $_SERVER['HTTP_USER_AGENT'],
    'details' => $details
  ];
  error_log(json_encode($logEntry));
}