Another enhancement to consider: after signal is processed, it's token could by invalidated. This can be achieved by removing token stored in session.

It is maybe possible to use Length extension attack against secured-links. I don't have now time to study and verify whether this is true or not.

If the attack is proven to be feasible, we should use HMAC instead of plain MD5.

Verify that http://breachattack.com/ does not affect this library is that is is properly mitigated.

Function random_bytes from paragonie/random_compat library can throw an exception. It is very rare situation, but it really happens on our production server. I suggest to encapsulate this code:

$session->token = function_exists('random_bytes')
    ? random_bytes(16)
    : Nette\Utils\Random::generate(16, "\x00-\xFF");

to try/catch block. In catch will be Random::generate()

nette/application#246

PHP Warning: Declaration of Nextras\Application\UI\SecuredLinksPresenterTrait::link(string $destination, $args = Array): string should be compatible with Nette\Application\UI\Component::link(string $destination, ...$args): string

nette/application@a987d58

It seems that only signals can be protected. But I usually use render or action methods for actions which should be protected (e.g. renderDelete).

Kde to pouziva Nette/Utils? Koukal jsem do src, ale bud jsem slepej a nebo jsem to v hlavicce nikde nenasel?
Pokud nejsem slepej, tak vyhodit z composer.json?

Annotation /** @secured*/ silently fails.

Hello, what about nette 3.0 supports?

See the same issue as nette/forms#36 on CsrfProtection on Nette Forms.

Tento PR #31 co se dělal pro verzi 3.1.4 nefunguje na verzi 3.1.5 https://github.com/nette/application/releases/tag/v3.1.5.
Vypadá že tam někdo reportoval že to byl asi BC break tak se to vrátilo do stavu jak to bylo před verzí 3.1.4.

Nevím zda by stačil revert toho PR pouze nebo už není žádoucí vracet PHP 7.1.

I would like to set a custom expiration for session section. I can do it by myself, but it would by nice to have some handy function for this. Something like:

public function setExpiration($expiration)
{
    $section = $this->getSession('Nextras.Application.UI.SecuredLinksPresenterTrait');
    $section->setExpiration($expiration);
}

Hi, can you release tagged version for Nette 3, please? Thank you.

This library declares compatibility with PHP ^7.2 in composer.json. However, release 1.10.0 requires PHP 8.0. because it uses ReflectionClass::getAttributes() method.

Can you please create a new release of the package? In particular, I need nette/utils version 4 to be in the new release, i.e., the following commit c5a0137. Thanks a lot.

We currently use in are app ugly workaround

$params = array_map(
	function ($param) {
		return is_object($param) && method_exists($param, 'getId') ? $param->getId() : $param;
	},
	$params
);

For obvious reasons I get this error:

Recoverable Error
Object of class ... could not be converted to string

For now I'm using this workaround:

    use SecuredLinksPresenterTrait {
        getCsrfToken as private traitGetCsrfToken;
    }

    public function getCsrfToken($control, $method, $params)
    {
        array_walk($params, function (&$value) {
            if (is_object($value)) {
                $value = spl_object_hash($value);
            }
        });
        return $this->traitGetCsrfToken($control, $method, $params);
    }

Should I send a PR with this change or are you against it?

I keep receiving "Invalid token" error messages when signal parameter is called $order.

protected function handleSetOrder($order);

see this commit: 752ad93