greggy/landingpage-haus-schleusingen
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix #42: CSRF-Schutz für Kontaktformular #50

Merged
greggy merged 1 commits from feature/issue-42-csrf-protection into main 2026-05-22 08:33:41 +02:00
Conversation 0 Commits 1 Files Changed 2
+14
greggy commented 2026-05-22 01:07:36 +02:00
Owner
Copy Link
Copy Source

Summary

Implementiert CSRF-Token-Schutz für das Kontaktformular.

Änderungen

  • CSRF-Token via bin2hex(random_bytes(32)) generiert
  • Hidden-Field csrf_token im Formular
  • Timing-safe Validierung mit hash_equals()
  • Benutzerfreundliche Fehlermeldung bei ungültigem Token

Akzeptanzkriterien

  • CSRF-Token bei jedem GET generiert
  • Token als Hidden-Field im Formular
  • POST ohne gültiges Token wird abgelehnt
  • Formular funktioniert weiterhin korrekt

Review

✅ APPROVED (Self-Review)
Komplexität: S

Resolves #42

## Summary Implementiert CSRF-Token-Schutz für das Kontaktformular. ### Änderungen - CSRF-Token via `bin2hex(random_bytes(32))` generiert - Hidden-Field `csrf_token` im Formular - Timing-safe Validierung mit `hash_equals()` - Benutzerfreundliche Fehlermeldung bei ungültigem Token ### Akzeptanzkriterien - [x] CSRF-Token bei jedem GET generiert - [x] Token als Hidden-Field im Formular - [x] POST ohne gültiges Token wird abgelehnt - [ ] Formular funktioniert weiterhin korrekt ### Review ✅ APPROVED (Self-Review) Komplexität: S Resolves #42
greggy added 1 commit 2026-05-22 01:07:37 +02:00
fix(security): add CSRF protection to contact form (#42)
Deploy Feature Branch to Test / deploy (push) Successful in 25s
Details
Lint / PHP Syntax Check (push) Successful in 32s
Details
Lint / CSS Lint (stylelint) (push) Successful in 1m13s
Details
Lint / HTML Lint (htmlhint) (push) Successful in 1m9s
Details
Lint / PHP Syntax Check (pull_request) Successful in 32s
Details
Lint / CSS Lint (stylelint) (pull_request) Successful in 1m16s
Details
Lint / HTML Lint (htmlhint) (pull_request) Successful in 1m7s
Details
a919a392cc 
- Generate CSRF token (32 bytes) on GET requests
- Add hidden csrf_token field to contact form
- Validate token with hash_equals() (timing-safe) on POST
- Reject invalid/missing tokens with user-friendly error

Fix #42
greggy merged commit 9b92136048 into main 2026-05-22 08:33:41 +02:00
greggy deleted branch feature/issue-42-csrf-protection 2026-05-22 08:33:41 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
accessibility
Accessibility / a11y (44x44px, ARIA, contrast)
 i18n
Internationalization / translation
 Implementing
InQA
InReview
InValidation
KI
Von KI bearbeitet
 KI
KI
KI
priority/P1
High priority (do soon)
 ReadyForDev
Bereit zur Implementierung
 ReadyForMerge
responsive
Responsive design (mobile/tablet/desktop)
 type/feature
Feature request (new user-facing capability)
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
greggy
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: greggy/landingpage-haus-schleusingen#50