In this article, I will teach you how to add CSRF token for admin login page.

• Add a hidden CSRF token in the admin login page to defend against CSRF attack. System will validate the CSRF token when a request is sent to server to login into the administrator panel.

• If the client token is different with the token saved in the server, the request will be terminated and a error feedback will be shown in the popup window.

Steps to apply this security plugin for your admin login page

Step 1. Open admin/includes/jsons/login.php to edit as follow:

• Find following code:

if ( !empty($_REQUEST['user_name']) && !empty($_REQUEST['user_password']) ) {

• add following code before it:

if ( ! isset($_POST['token']) || ! $osC_Session->validateToken($_POST['token'])) {
        $response['success'] = false;
        $response['feedback'] = 'Invalid token!';
        exit($toC_Json->encode($response));
}

Step 2. Open admin/templates/default/login/login.php to edit as follow:

• Find following code:

 {xtype: 'textfield', name: 'user_password', fieldLabel: '<?php echo $osC_Language->get("field_password"); ?>', inputType: 'password', allowBlank:false},

• Add following code after it:

{xtype: 'textfield', name: 'token', inputType: 'hidden', value: '<?php echo $_SESSION["_token"]?>'}

Done. I strongly recommend you to apply this plugin for your admin panel. This will prevent attacher accessing your admin panel.

Looking for quality TomatoCart hosting? Check out Arvixe Web Hosting