security::csrf::token (private)

 security::csrf::token [ -tokenname tokenname ]

Defined in packages/acs-tcl/tcl/security-procs.tcl

Generate a CSRF token and return it

Switches:

-tokenname (optional, defaults to "__csrf_token")

Returns:

CSRF token

Author:

Gustaf Neumann

Partial Call Graph (max 5 caller/called nodes):

Testcases:

No testcase defined.

Source code:

        #
        # We compute the token only once per requests. If it was already
        # computed, and we can pick it up and return it. Otherwise,
        # we compute it new.
        #
        set globalTokenName ::$tokenname
        if {[info exists $globalTokenName] && [set $globalTokenName] ne ""} {
            set token [set $globalTokenName]
        } else {
            set secret [ns_config "ns/server/[ns_info server]/acs" parameterSecret ""]
            if {[namespace which ::crypto::hmac] ne ""} {
                set token [::crypto::hmac string $secret [session_id]]
            } else {
                set token [ns_sha1 $secret-[session_id]]
            }
            set $globalTokenName $token
        }

        return $token

Generic XQL file:

packages/acs-tcl/tcl/security-procs.xql

PostgreSQL XQL file:

packages/acs-tcl/tcl/security-procs-postgresql.xql

Oracle XQL file:

packages/acs-tcl/tcl/security-procs-oracle.xql