CSRFトークン インタビューズ

<meta name="csrf-param" content="authenticity_token" /> 
<meta name="csrf-token" content="OGjn8n1qaV0(略)lZKu4z3bkXY6Q==" />

<input type="hidden" name="authenticity_token" value="qrH7NiMO(略)f7B1YBg==" />

      def real_csrf_token(session)
        session[:_csrf_token] ||= SecureRandom.base64(AUTHENTICITY_TOKEN_LENGTH)
        Base64.strict_decode64(session[:_csrf_token])
      end

<input type="hidden" id="OWASP_CSRFTOKEN" name="OWASP_CSRFTOKEN" value="KBS8-DLOB-(略)-39TX-I8DB-RB7Z"/>

    public static String generateRandomId(SecureRandom sr, int len) {
        StringBuilder sb = new StringBuilder();

        for (int i = 1; i < len + 1; i++) {
            int index = sr.nextInt(CHARSET.length);
            char c = CHARSET[index];
            sb.append(c);

            if ((i % 4) == 0 && i != 0 && i < len) {
                sb.append('-');
            }
        }

        return sb.toString();
    }

<input name="_token" type="hidden" value="TqMhR6ARyGz4OKC4GKvus9h8CTlvDWGzgDtt6yQV">

    /**
     * Regenerate the CSRF token value.
     *
     * @return void
     */
    public function regenerateToken()
    {
        $this->put('_token', Str::random(40));
    }

    /**
     * Generate a more truly "random" alpha-numeric string.
     *
     * @param  int  $length
     * @return string
     */
    public static function random($length = 16)
    {
        $string = '';
        while (($len = strlen($string)) < $length) {
            $size = $length - $len;
            $bytes = random_bytes($size);
            $string .= substr(str_replace(['/', '+', '='], '', base64_encode($bytes)), 0, $size);
        }
        return $string;
    }

<input type="hidden" id="_wpnonce" name="_wpnonce" value="5825e1f473" />

/**
 * Creates a cryptographic token tied to a specific action, user, user session,
 * and window of time.
 *
 * @since 2.0.3
 * @since 4.0.0 Session tokens were integrated with nonce creation
 *
 * @param string|int $action Scalar value to add context to the nonce.
 * @return string The token.
 */
function wp_create_nonce($action = -1) {
        $user = wp_get_current_user();
        $uid = (int) $user->ID;
        if ( ! $uid ) {
                /** This filter is documented in wp-includes/pluggable.php */
                $uid = apply_filters( 'nonce_user_logged_out', $uid, $action );
        }
        $token = wp_get_session_token();
        $i = wp_nonce_tick();
        return substr( wp_hash( $i . '|' . $action . '|' . $uid . '|' . $token, 'nonce' ), -12, 10 );
}
endif;

<input type="hidden" name="magic_token" value="7G2Pziy2jV1tRW70DcIiHzPJ7hzxu3Idk27WhwPO" />

sub magic_token {
    my $auth = shift;
    require MT::Util;
    my $pw = $auth->column('password');
    if ( $pw eq '(none)' ) {
        $pw
            = $auth->id . ';'
            . $auth->name . ';'
            . ( $auth->email || '' ) . ';'
            . ( $auth->hint  || '' );
    }
    require MT::Util;
    MT::Util::perl_sha1_digest_hex($pw);
}

<input type="hidden" name="_csrfToken" value="58d2264fdee47c834b5f(略)d07bd6808cb60919"/>

    /**
     * Set the cookie in the response.
     *
     * Also sets the request->params['_csrfToken'] so the newly minted
     * token is available in the request data.
     *
     * @param \Cake\Network\Request $request The request object.
     * @param \Cake\Network\Response $response The response object.
     * @return void
     */
    protected function _setCookie(Request $request, Response $response)
    {
        $expiry = new Time($this->_config['expiry']);
        $value = hash('sha512', Security::randomBytes(16), false);
        $request->params['_csrfToken'] = $value;
        $response->cookie([
            'name' => $this->_config['cookieName'],
            'value' => $value,
            'expire' => $expiry->format('U'),
            'path' => $request->webroot,
            'secure' => $this->_config['secure'],
            'httpOnly' => $this->_config['httpOnly'],
        ]);
    }

<input type="hidden" name="form_token" value="dQGBMO3QEJ5DjKakM1wSFlId9VLQ5HVBR9Ak0YqsVo0" />

  /**
   * Generates a token based on $value, the user session, and the private key.
   *
   * The generated token is based on the session of the current user. Normally,
   * anonymous users do not have a session, so the generated token will be
   * different on every page request. To generate a token for users without a
   * session, manually start a session prior to calling this function.
   *
   * @param string $value
   *   (optional) An additional value to base the token on.
   *
   * @return string
   *   A 43-character URL-safe token for validation, based on the token seed,
   *   the hash salt provided by Settings::getHashSalt(), and the
   *   'drupal_private_key' configuration variable.
   *
   * @see \Drupal\Core\Site\Settings::getHashSalt()
   * @see \Symfony\Component\HttpFoundation\Session\SessionInterface::start()
   */
  public function get($value = '') {
    $seed = $this->sessionMetadata->getCsrfTokenSeed();
    if (empty($seed)) {
      $seed = Crypt::randomBytesBase64();
      $this->sessionMetadata->setCsrfTokenSeed($seed);
    }

    return $this->computeToken($seed, $value);
  }

public static function hmacBase64($data, $key) {
  // $data and $key being strings here is necessary to avoid empty string
  // results of the hash function if they are not scalar values. As this
  // function is used in security-critical contexts like token validation it
  // is important that it never returns an empty string.
  if (!is_scalar($data) || !is_scalar($key)) {
    throw new \InvalidArgumentException('Both parameters passed to \Drupal\Component\Utility\Crypt::hmacBase64 must be scalar values.');
  }

  $hmac = base64_encode(hash_hmac('sha256', $data, $key, TRUE));
  // Modify the hmac so it's safe to use in URLs.
  return str_replace(['+', '/', '='], ['-', '_', ''], $hmac);
}

<input type="hidden" name="bbbb8070c831e37bbd16514ebc4911e0" value="1" />

    /**
     * Generate a random password
     *
     * @param   integer  $length  Length of the password to generate
     *
     * @return  string  Random Password
     *
     * @since   11.1
     */
    public static function genRandomPassword($length = 8)
    {
        $salt = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
        $base = strlen($salt);
        $makepass = '';
        /*
         * Start with a cryptographic strength random string, then convert it to
         * a string with the numeric base of the salt.
         * Shift the base conversion on each character so the character
         * distribution is even, and randomize the start shift so it's not
         * predictable.
         */
        $random = JCrypt::genRandomBytes($length + 1);
        $shift = ord($random[0]);
        for ($i = 1; $i <= $length; ++$i)
        {
            $makepass .= $salt[($shift + ord($random[$i])) % $base];
            $shift += ord($random[$i]);
        }
        return $makepass;
    }

    /**
     * Checks for a form token in the request.
     *
     * Use in conjunction with JHtml::_('form.token') or JSession::getFormToken.
     *
     * @param   string  $method  The request method in which to look for the token key.
     *
     * @return  boolean  True if found and valid, false otherwise.
     *
     * @since   12.1
     */
    public static function checkToken($method = 'post')
    {
        $token = self::getFormToken();
        $app = JFactory::getApplication();
        if (!$app->input->$method->get($token, '', 'alnum'))
        {
            if (JFactory::getSession()->isNew())
            {
                // Redirect to login screen.
                $app->enqueueMessage(JText::_('JLIB_ENVIRONMENT_SESSION_EXPIRED'), 'warning');
                $app->redirect(JRoute::_('index.php'));
                return true;
            }
            return false;
        }
        return true;
    }

<input type="hidden" name="_csrf" value="2a0e43b3-f6c2-4d74-8e61-62765c71e1e2"/>

    private String createNewToken() {
        return UUID.randomUUID().toString();
    }