title: CodeIgniter CSRF Server-Side Implementation?
body: <p>During some basic security test. When the apache request sent with <strong>same custom</strong> <code>header-CSRF-cookie</code> and <code>POST-CSRF-Cookie</code>.</p>
  <p>CSRF token get validated and request is processed.</p>
  <p>I have gone through the implementation.</p>
  <pre><code>$valid = isset($_POST[$this-&gt;_csrf_token_name], $_COOKIE[$this-&gt;_csrf_cookie_name])
              &amp;&amp; is_string($_POST[$this-&gt;_csrf_token_name]) &amp;&amp; is_string($_COOKIE[$this-&gt;_csrf_cookie_name])
              &amp;&amp; hash_equals($_POST[$this-&gt;_csrf_token_name], $_COOKIE[$this-&gt;_csrf_cookie_name]);
  </code></pre>
  <p>Both verifying data is from client-side.</p>
  <p><strong>hash_equals($_POST[$this-&gt;_csrf_token_name], $_COOKIE[$this-&gt;_csrf_cookie_name])</strong></p>
  <p>Is there any purpose that CodeIgniter implementation in this ways.</p>
  <p>Does anyone tried to implement it in <strong>session</strong> instead of <strong>cookie</strong>?</p>