$expected_csrf_token = $_SESSION['csrf_token'];

<?php echo form_open("/login/check"); ?>
<br>
<br> &lt;?= validation_errors(); ?&gt;
<br> &lt;div class=&quot;input-group mb-3&quot;&gt;
<br> &lt;input required type=&quot;text&quot; class=&quot;form-control&quot; placeholder=&quot;username&quot; name=&quot;username&quot;&gt;
<br> &lt;div class=&quot;input-group-append&quot;&gt;
<br> &lt;div class=&quot;input-group-text&quot;&gt;
<br> &lt;span class=&quot;fas fa-user&quot;&gt;&lt;/span&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;div class=&quot;input-group mb-3&quot;&gt;
<br> &lt;input required type=&quot;password&quot; class=&quot;form-control&quot; placeholder=&quot;Password&quot; name=&quot;password&quot;&gt;
<br> &lt;div class=&quot;input-group-append&quot;&gt;
<br> &lt;div class=&quot;input-group-text&quot;&gt;
<br> &lt;span class=&quot;fas fa-lock&quot;&gt;&lt;/span&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;div class=&quot;social-auth-links text-center mb-3&quot;&gt;
<br> &lt;button type=&quot;submit&quot; class=&quot;btn btn-block btn-primary&quot;&gt;
<br> Login
<br> &lt;/button&gt;
<br> &lt;/div&gt;
<br>
<br>&lt;?php echo form_close(); ?&gt;

function check(){
<br>
<br> $this-&gt;validation_helper-&gt;set_rules('username','username','required|callback_login_check');
<br>
<br> $this-&gt;validation_helper-&gt;set_rules('password','password','required');
<br>
<br> $result = $this-&gt;validation_helper-&gt;run();
<br>
<br> if($result === false){
<br> redirect('/login');
<br> }
<br>
<br>
<br> $username = post('username');
<br>
<br> $employee = $this-&gt;_login_user($username);
<br>
<br> $_SESSION['employee'] = $employee;
<br>
<br> redirect('/dashboard');
<br>
<br> }
<br>
<br> function login_check($username){
<br> $error_msg = &quot;your username and/or password combination is invalid&quot;;
<br>
<br> $user_obj = $this-&gt;model-&gt;get_one_where('username',$username,'user_login');
<br> if($user_obj === false){
<br> return $error_msg;
<br> }
<br>
<br>
<br> $password = post('password');
<br> $stored_password = $user_obj-&gt;password;
<br> $is_password_valid = $this-&gt;_verify_hash($password,$stored_password);
<br>
<br> if(!$is_password_valid){
<br> return $error_msg;
<br> }
<br>
<br> return true;
<br> }
<br>
<br> function _login_user(string $username){
<br>
<br> $user = $this-&gt;model-&gt;get_one_where('username',$username,'user_login');
<br>
<br> $employee = $this-&gt;model-&gt;get_one_where('employee_id',$user-&gt;employee_id,'employees');
<br>
<br> $trongate_user_id = $employee-&gt;trongate_user_id;
<br>
<br> $this-&gt;module('trongate_tokens');
<br>
<br> $this-&gt;trongate_tokens-&gt;_generate_token([
<br> 'user_id' =&gt; $trongate_user_id
<br> ]);
<br>
<br> return $employee;
<br>
<br> }
<br>
<br> function _verify_hash($plain_text_str, $hashed_string) {
<br> $result = password_verify($plain_text_str, $hashed_string);
<br> return $result; //TRUE or FALSE
<br> }

$expected_csrf_token = $_SESSION['csrf_token'];

&lt;?php
<br>session_start();
<br>
<br>$_SESSION['foo'] = 'bar';
<br>
<br>header(&quot;Location: page.php&quot;);

&lt;?php
<br>session_start();
<br>
<br>echo $_SESSION['foo']; //this outputs bar
<br>?&gt;

// Test controller
<br>&lt;?php
<br>class Test extends Trongate {
<br>
<br> function index() {
<br> $data['view_module'] = 'test';
<br> $this-&gt;view('test', $data);
<br> /* Uncomment the lines below,
<br> * Change the template method name,
<br> * Remove lines above, if you want to load to the template
<br> */
<br> //$data['view_module'] = 'test';
<br> //$data['view_file'] = 'display';
<br> //$this-&gt;template('template method here', $data);
<br> }
<br> function check() {
<br>
<br> $this-&gt;validation_helper-&gt;set_rules('username', 'username', 'required|callback_login_check');
<br>
<br> $this-&gt;validation_helper-&gt;set_rules('password', 'password', 'required');
<br>
<br> $result = $this-&gt;validation_helper-&gt;run();
<br>
<br> die(&quot;csrf check OK&quot;);
<br>
<br> if ($result === false) {
<br> redirect('/login');
<br> }
<br>
<br>
<br> $username = post('username');
<br>
<br> $employee = $this-&gt;_login_user($username);
<br>
<br> $_SESSION['employee'] = $employee;
<br>
<br> redirect('/dashboard');
<br> }
<br>
<br> function login_check($username) {
<br>
<br> // $error_msg = &quot;your username and/or password combination is invalid&quot;;
<br>
<br> // $user_obj = $this-&gt;model-&gt;get_one_where('username', $username, 'user_login');
<br> // if ($user_obj === false) {
<br> // return $error_msg;
<br> // }
<br>
<br>
<br> // $password = post('password');
<br> // $stored_password = $user_obj-&gt;password;
<br> // $is_password_valid = $this-&gt;_verify_hash($password, $stored_password);
<br>
<br> // if (!$is_password_valid) {
<br> // return $error_msg;
<br> // }
<br>
<br> return true;
<br> }
<br>
<br> function _login_user(string $username) {
<br>
<br> $employee = 1;
<br>
<br> // $user = $this-&gt;model-&gt;get_one_where('username', $username, 'user_login');
<br>
<br> // $employee = $this-&gt;model-&gt;get_one_where('employee_id', $user-&gt;employee_id, 'employees');
<br>
<br> // $trongate_user_id = $employee-&gt;trongate_user_id;
<br>
<br> // $this-&gt;module('trongate_tokens');
<br>
<br> // $this-&gt;trongate_tokens-&gt;_generate_token([
<br> // 'user_id' =&gt; $trongate_user_id
<br> // ]);
<br>
<br> return $employee;
<br> }
<br>
<br> function _verify_hash($plain_text_str, $hashed_string) {
<br> $result = password_verify($plain_text_str, $hashed_string);
<br> return $result; //TRUE or FALSE
<br> }
<br>}

// test.php View file - NOTE no backslash in open_form(&quot;test/check&quot;);
<br>&lt;!DOCTYPE html&gt;
<br>&lt;html lang=&quot;en&quot;&gt;
<br>
<br>&lt;head&gt;
<br> &lt;meta charset=&quot;UTF-8&quot;&gt;
<br> &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
<br> &lt;title&gt;Document&lt;/title&gt;
<br>&lt;/head&gt;
<br>
<br>&lt;body&gt;
<br>
<br> &lt;h1&gt;Help_bar request by vimkaf - CSRF issue&lt;/h1&gt;
<br>
<br> &lt;?php echo form_open(&quot;test/check&quot;); ?&gt;
<br>
<br> &lt;?= validation_errors(); ?&gt;
<br> &lt;div class=&quot;input-group mb-3&quot;&gt;
<br> &lt;input required type=&quot;text&quot; class=&quot;form-control&quot; placeholder=&quot;username&quot; name=&quot;username&quot;&gt;
<br> &lt;div class=&quot;input-group-append&quot;&gt;
<br> &lt;div class=&quot;input-group-text&quot;&gt;
<br> &lt;span class=&quot;fas fa-user&quot;&gt;&lt;/span&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;div class=&quot;input-group mb-3&quot;&gt;
<br> &lt;input required type=&quot;password&quot; class=&quot;form-control&quot; placeholder=&quot;Password&quot; name=&quot;password&quot;&gt;
<br> &lt;div class=&quot;input-group-append&quot;&gt;
<br> &lt;div class=&quot;input-group-text&quot;&gt;
<br> &lt;span class=&quot;fas fa-lock&quot;&gt;&lt;/span&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;/div&gt;
<br> &lt;div class=&quot;social-auth-links text-center mb-3&quot;&gt;
<br> &lt;button type=&quot;submit&quot; class=&quot;btn btn-block btn-primary&quot;&gt;
<br> Login
<br> &lt;/button&gt;
<br> &lt;/div&gt;
<br>
<br> &lt;?php echo form_close(); ?&gt;
<br>
<br>&lt;/body&gt;
<br>
<br>&lt;/html&gt;

// added a die()
<br> private function csrf_protect() {
<br>
<br> die(&quot;csrf check ahoy!&quot;);
<br>
<br> // Make sure they have posted csrf_token
<br> if (!isset($_POST['csrf_token'])) {
<br> $this-&gt;csrf_block_request();
<br> } else {
<br> $posted_csrf_token = $_POST['csrf_token'];
<br> $expected_csrf_token = $_SESSION['csrf_token'];
<br>
<br> if (!hash_equals($expected_csrf_token, $posted_csrf_token)) {
<br> $this-&gt;csrf_block_request();
<br> }
<br>
<br> unset($_POST['csrf_token']);
<br> }
<br> }

C:\Windows\System32\drivers\etc

127.0.0.1 dafa.local

http://dafa.local/a_4/test

Warning: Undefined array key &quot;csrf_token&quot; in D:\xampp\htdocs\a_4\engine\tg_helpers\validation_helper.php on line 560
<br>
<br>Fatal error: Uncaught TypeError: hash_equals(): Argument #1 ($known_string) must be of type string, null given in D:\xampp\htdocs\a_4\engine\tg_helpers\validation_helper.php:562 Stack trace: #0 D:\xampp\htdocs\a_4\engine\tg_helpers\validation_helper.php(562): hash_equals(Object(SensitiveParameterValue), Object(SensitiveParameterValue)) #1 D:\xampp\htdocs\a_4\engine\tg_helpers\validation_helper.php(87): Validation_helper-&gt;csrf_protect() #2 D:\xampp\htdocs\a_4\modules\test\controllers\Test.php(21): Validation_helper-&gt;run() #3 D:\xampp\htdocs\a_4\engine\Core.php(303): Test-&gt;check('') #4 D:\xampp\htdocs\a_4\engine\Core.php(258): Core-&gt;invoke_controller_method() #5 D:\xampp\htdocs\a_4\engine\Core.php(21): Core-&gt;serve_controller() #6 D:\xampp\htdocs\a_4\public\index.php(5): Core-&gt;__construct() #7 {main} thrown in D:\xampp\htdocs\a_4\engine\tg_helpers\validation_helper.php on line 562

&lt;?php echo form_close();
<br> var_dump($_SESSION);

array(1) { [&quot;csrf_token&quot;]=&gt; string(64) &quot;9a6c75ce6f133eccaa3ed2fe9583b9d6879c6e699b441f99746f2ab4861b84bd&quot; }

&lt;?php echo form_open(&quot;test/check&quot;); ?&gt;

&lt;?php echo form_open(&quot;http://dafa.local/a_4/test/check&quot;); ?&gt;

https://trongate.io/help_bar_threads/display/db4mMX2qG47u57Fs