1 April 2025

CSRF (Cross-Site Request Forgery) is an attack where a malicious website tricks a user's browser into making unwanted actions on a different site where the user is authenticated, exploiting the user's session to perform unauthorized operations. In Drupal 7, use the drupal_get_token() function to generate a CSRF token and validate it with drupal_valid_token().

Generating Token (in a form):

Source code viewer
  1. $form['csrf_token'] = array(
  2.   '#type' => 'hidden',
  3.   '#value' => drupal_get_token('my_form'),
  4. );
  5.  
Programming Language: PHP

Validating Token (on submit):

Source code viewer
  1. if (!drupal_valid_token($_POST['csrf_token'], 'my_form')) {
  2.   drupal_set_message(t('Invalid token.'), 'error');
  3.   return;
  4. }
  5.  
Programming Language: PHP