Versions:

This document contains information for an outdated version and may not be maintained any more. If some of your projects still use this version, consider upgrading as soon as possible.

Form Security

Whenever you are accepting or asking users to input data to your application there comes an added responsibility that it should be done as safely as possible. Below outlines the things to consider when building your forms.

Cross-Site Request Forgery (CSRF)

SilverStripe protect users against [Cross-Site Request Forgery](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) (known as CSRF) by adding a SecurityID HiddenField to each Form instance. The SecurityID contains a random string generated by SecurityToken to identify the particular user request vs a third-party forging fake requests.

For more information on Cross-Site Request Forgery, consult the [OWASP](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) website.

The SecurityToken automatically added looks something like:

$form = new Form(..);
echo $form->getSecurityToken()->getValue();

// 'c443076989a7f24cf6b35fe1360be8683a753e2c'

This token value is passed through the rendered Form HTML as a HiddenField.

<input type="hidden" name="SecurityID" value="c443076989a7f24cf6b35fe1360be8683a753e2c" class="hidden"  />

The token should be present whenever a operation has a side effect such as a POST operation.

It can be safely disabled for GET requests as long as it does not modify the database (i.e a search form does not normally require a security token).

$form = new Form(..);
$form->disableSecurityToken();

Do not disable the SecurityID for forms that perform some modification to the users session. This will open your application up to CSRF security holes.

Strict Form Submission

Forms should be limited to the intended HTTP verb (mostly GET or POST) to further reduce attack exposure. Without this check, forms that rely on GET can be submitted via POST or PUT or vice-versa potentially leading to application errors or edge cases.

$form = new Form(..);

$form->setFormMethod('POST');
$form->setStrictFormMethodCheck(true);

// or alternative short notation..
$form->setFormMethod('POST', true);

Spam and Bot Attacks

SilverStripe has no built-in protection for detailing with bots, captcha or other spam protection methods. This functionality is available as an additional Spam Protection module if required. The module provides an consistent API for allowing third-party spam protection handlers such as Recaptcha and Mollom to work within the Form API.

API Documentation

Was this article helpful?