Rendering views for CSRF errors: Build Your Own PHP Framework

00:04

create any other if statements you want in here to check the exception. So, for example, you could check if the exception is an instance of a particular exception that you've added in your application, and then you can perform any action that you want in here, either by logging something, displaying a view,

00:22

whatever you want to do. What we're going to look at now, though, is creating a custom exception with an HTTP status code, and that is going to be for our cross-site request forgery failure. Now, let's go ahead and just recreate this in the browser.

00:35

So I'm going to go ahead and hit Log In here, and let's try and just sign in. We know that that works nicely, but what if we modified the code? So we could do this in a couple of ways, but let's just go ahead and get rid of the part of the value here, and let's try and hit Log In.

00:52

We get this error just here, which, remember, comes from the cross-site request forgery middleware provided by that slim guard class. So we want to customize this. Now, there are infinite ways that you can customize certain exceptions that are thrown.

01:08

In the case of our cross-site request forgery, if we come over to our cross-site request forgery service provider, what we can do on the guard class that we've been using is we can set a failure handler. So it has a method here that sets the failure handler within this guard, and then

01:27

when we get down to that process method, we know that it tries to access, if we just come down to here, handle failure, and that will give us what we've used in there. So basically, we can overwrite the failure handler with our own custom exception, which has an HTTP code, and then we can render a view.

01:47

So the goal here is to render a nice view if the token doesn't match to ask the user to refresh the page. So let's go ahead and start to do this now. So we're going to go ahead and set the failure handler in here.

01:58

This will just be a closure that does something. So in our case, we're just going to throw an exception. So let's throw a new exception in here. We don't have that at the moment.

02:07

Let's create our own custom one. So let's create our class in here called cross-site request forgery token exception, and let's create this out. Okay, so we're going to throw this from that cross-site request forgery failure handler.

02:22

So let's throw a new cross-site request forgery token exception. It's probably not filling this in because it doesn't look like an exception at the moment, but let's go ahead and import that anyway. Okay, let's go over to the exception, and for this to be an exception,

02:37

we need to extend an HTTP exception. We could extend a standard exception, but in our case, we want this to be an HTTP exception. So this is under, if we just find this by going into league root HTTP, this is what we want to throw.

02:54

Okay, so if we take a look, we can pretty much just copy any of the other HTTP exceptions that we have. So we already saw the not found exception over here, which just, if we just open up the right one, so this one just here, not found exception, all this does is it,

03:12

inside of the constructor, calls the parent constructor with the right code. So we're going to grab all of this inside of here, go back over to our own exception, and just paste this in. Now, what we can do is change around the message.

03:24

So you could, again, remember in our handler, send that message down to the view. If you want to do, you could send the entire exception down. So you could actually render this out with the contents of the message. Let's go ahead and change that over to cross-site request forgery token mismatch.

03:42

And let's change the status code over here to 422, which is pretty standard for most of these. Okay, now that we've got that, and we're throwing it over from our cross-site request forgery service provider, we should be good. Let's just try this out first of all.

03:58

So let's go back over to login. I'm going to go ahead and modify the value of the token in here and hit login. And there we go. Great.

04:05

We got our own custom exception thrown specifically for this package. Now, what we need to do is because we've already set up that automatic rendering of views for any of the status codes that we have on exceptions, we just need to go ahead and create our new view. So let's go and create 422, which is the status that we gave it.

04:27

And we'll just say token expired, or let's make it a bit more user-friendly, page expired. Please go back and refresh. Which is pretty common because if a user is sat around on a page for too long, they're going to end up with an expired token, so we at least want to tell them what to do.

04:43

Okay, so now if we were to hang around on this page too long and the token ended up expiring, when we hit login now, we get our own custom page. So there we go. Anywhere that you want to throw an HTTP exception now, you can customize this much like we've done

05:01

with this custom cross-site request forgery exception, set the message, set the code, and the view we rendered for you. Otherwise, over in your handler, just create out an if statement in here and perform an action if it's an instance of any custom exceptions you've created.

Sign up to access "Build Your Own PHP Framework" right now.

Episodes

Transcript

Episode summary

Episode discussion