CsrfTrait
Trait exposing the CSRF token to controllers and templates.
The Slim\Csrf\Guard instance is provided by dependency injection (an init array or a
PSR-11 container), like HttpCacheTrait/FileEncryptionTrait — it is never
instantiated here. When the guard is not configured every accessor degrades gracefully
(null, [] or false) instead of failing.
Token availability: Guard::getTokenName()/getTokenValue() only return a value once
the guard middleware (or self::generateCsrfToken()) has populated the key pair for the
current request. The field-name keys (self::csrfTokenNameKey()/self::csrfTokenValueKey())
are always available.
Tags
Table of Contents
Constants
- CSRF : string = 'csrf'
- The init key holding the DI-provided `Slim\Csrf\Guard` instance.
Properties
- $csrf : Guard|null
- The CSRF guard reference (optional).
Methods
- csrfTokenName() : string|null
- Returns the current CSRF token **name**, or `null` when no token has been generated (or the guard is not configured).
- csrfTokenNameKey() : string|null
- Returns the field name under which the CSRF token **name** is submitted (e.g. `csrf_name`), or `null` when the guard is not configured.
- csrfTokens() : array<string, string>
- Returns the current CSRF token as a `[ nameKey => name, valueKey => value ]` map, ready to be injected into a template or a form.
- csrfTokenValue() : string|null
- Returns the current CSRF token **value**, or `null` when no token has been generated (or the guard is not configured).
- csrfTokenValueKey() : string|null
- Returns the field name under which the CSRF token **value** is submitted (e.g. `csrf_value`), or `null` when the guard is not configured.
- generateCsrfToken() : array<string, string>
- Generates a fresh CSRF token pair and stores it.
- initializeCsrf() : static
- Initialize the internal CSRF guard.
- validateCsrf() : bool
- Validates a CSRF token pair against the value stored by the guard.
Constants
CSRF
The init key holding the DI-provided `Slim\Csrf\Guard` instance.
public
string
CSRF
= 'csrf'
Properties
$csrf
The CSRF guard reference (optional).
protected
Guard|null
$csrf
= null
Methods
csrfTokenName()
Returns the current CSRF token **name**, or `null` when no token has been generated (or the guard is not configured).
public
csrfTokenName() : string|null
Return values
string|null —The current token name, or null when unavailable.
csrfTokenNameKey()
Returns the field name under which the CSRF token **name** is submitted (e.g. `csrf_name`), or `null` when the guard is not configured.
public
csrfTokenNameKey() : string|null
Return values
string|null —The token-name field key, or null when the guard is not configured.
csrfTokens()
Returns the current CSRF token as a `[ nameKey => name, valueKey => value ]` map, ready to be injected into a template or a form.
public
csrfTokens() : array<string, string>
Return values
array<string, string> —The token pair, or an empty array when the guard is not configured or no token has been generated yet.
csrfTokenValue()
Returns the current CSRF token **value**, or `null` when no token has been generated (or the guard is not configured).
public
csrfTokenValue() : string|null
Return values
string|null —The current token value, or null when unavailable.
csrfTokenValueKey()
Returns the field name under which the CSRF token **value** is submitted (e.g. `csrf_value`), or `null` when the guard is not configured.
public
csrfTokenValueKey() : string|null
Return values
string|null —The token-value field key, or null when the guard is not configured.
generateCsrfToken()
Generates a fresh CSRF token pair and stores it.
public
generateCsrfToken() : array<string, string>
Useful for a controller rendering a form when the guard middleware is not in the request
pipeline. Returns the same [ nameKey => name, valueKey => value ] shape as self::csrfTokens().
Tags
Return values
array<string, string> —The generated token pair, or an empty array when the guard is not configured.
initializeCsrf()
Initialize the internal CSRF guard.
public
initializeCsrf([array<string|int, mixed> $init = [] ][, ContainerInterface|null $container = null ]) : static
Priority order:
$init[self::CSRF]$container->get(Guard::class)when available in DI
Parameters
- $init : array<string|int, mixed> = []
-
Optional initialization array.
- $container : ContainerInterface|null = null
-
Optional DI container to retrieve the guard.
Tags
Return values
static —Returns the current instance for method chaining.
validateCsrf()
Validates a CSRF token pair against the value stored by the guard.
public
validateCsrf(string $name, string $value) : bool
Parameters
- $name : string
-
The submitted CSRF token name.
- $value : string
-
The submitted CSRF token value.
Return values
bool —true when the pair is valid; false when it is invalid or the guard is not configured.