This episode is for members only
Sign up to access "Build Your Own PHP Framework" right now.
Get started
Already a member? Sign in to continue
Playing
48. Rendering views for CSRF errors
Episodes
01. Setting up
02. Container
03. Application config
04. Routing and controllers
05. Views
06. Database
07. Authentication
08. CSRF Protection
09. Flashing messages
10. Validation
11. Middleware
12. Exception handling
Transcript
00:00
So you're now free to check this exception that's been thrown,
00:04
create any other if statements you want in here to check the exception. So, for example, you could check if the exception is an instance of a particular exception that you've added in your application, and then you can perform any action that you want in here, either by logging something, displaying a view,
00:22
whatever you want to do. What we're going to look at now, though, is creating a custom exception with an HTTP status code, and that is going to be for our cross-site request forgery failure. Now, let's go ahead and just recreate this in the browser.
00:35
So I'm going to go ahead and hit Log In here, and let's try and just sign in. We know that that works nicely, but what if we modified the code? So we could do this in a couple of ways, but let's just go ahead and get rid of the part of the value here, and let's try and hit Log In.
00:52
We get this error just here, which, remember, comes from the cross-site request forgery middleware provided by that slim guard class. So we want to customize this. Now, there are infinite ways that you can customize certain exceptions that are thrown.
01:08
In the case of our cross-site request forgery, if we come over to our cross-site request forgery service provider, what we can do on the guard class that we've been using is we can set a failure handler. So it has a method here that sets the failure handler within this guard, and then
01:27
when we get down to that process method, we know that it tries to access, if we just come down to here, handle failure, and that will give us what we've used in there. So basically, we can overwrite the failure handler with our own custom exception, which has an HTTP code, and then we can render a view.
01:47
So the goal here is to render a nice view if the token doesn't match to ask the user to refresh the page. So let's go ahead and start to do this now. So we're going to go ahead and set the failure handler in here.
01:58
This will just be a closure that does something. So in our case, we're just going to throw an exception. So let's throw a new exception in here. We don't have that at the moment.
02:07
Let's create our own custom one. So let's create our class in here called cross-site request forgery token exception, and let's create this out. Okay, so we're going to throw this from that cross-site request forgery failure handler.
02:22
So let's throw a new cross-site request forgery token exception. It's probably not filling this in because it doesn't look like an exception at the moment, but let's go ahead and import that anyway. Okay, let's go over to the exception, and for this to be an exception,
02:37
we need to extend an HTTP exception. We could extend a standard exception, but in our case, we want this to be an HTTP exception. So this is under, if we just find this by going into league root HTTP, this is what we want to throw.
02:54
Okay, so if we take a look, we can pretty much just copy any of the other HTTP exceptions that we have. So we already saw the not found exception over here, which just, if we just open up the right one, so this one just here, not found exception, all this does is it,
03:12
inside of the constructor, calls the parent constructor with the right code. So we're going to grab all of this inside of here, go back over to our own exception, and just paste this in. Now, what we can do is change around the message.
03:24
So you could, again, remember in our handler, send that message down to the view. If you want to do, you could send the entire exception down. So you could actually render this out with the contents of the message. Let's go ahead and change that over to cross-site request forgery token mismatch.
03:42
And let's change the status code over here to 422, which is pretty standard for most of these. Okay, now that we've got that, and we're throwing it over from our cross-site request forgery service provider, we should be good. Let's just try this out first of all.
03:58
So let's go back over to login. I'm going to go ahead and modify the value of the token in here and hit login. And there we go. Great.
04:05
We got our own custom exception thrown specifically for this package. Now, what we need to do is because we've already set up that automatic rendering of views for any of the status codes that we have on exceptions, we just need to go ahead and create our new view. So let's go and create 422, which is the status that we gave it.
04:27
And we'll just say token expired, or let's make it a bit more user-friendly, page expired. Please go back and refresh. Which is pretty common because if a user is sat around on a page for too long, they're going to end up with an expired token, so we at least want to tell them what to do.
04:43
Okay, so now if we were to hang around on this page too long and the token ended up expiring, when we hit login now, we get our own custom page. So there we go. Anywhere that you want to throw an HTTP exception now, you can customize this much like we've done
05:01
with this custom cross-site request forgery exception, set the message, set the code, and the view we rendered for you. Otherwise, over in your handler, just create out an if statement in here and perform an action if it's an instance of any custom exceptions you've created.
54 episodes•4 hrs 45 mins•1 year ago
Overview
Starting completely from scratch, build a modern PHP framework with all the features you’d expect.
Whether you’re new to PHP or not, this is a great exercise for learning what happens under the hood, arming you with knowledge you can apply anywhere you use PHP.
We’ll cover routing, controllers, views, the container, accessing the database, models, authentication, config, CSRF protection, exception handling, pagination, validation, flashing messages and much more.
Let’s dive in and build a PHP framework, step-by-step!
Alex Garrett-Smith
Hey, I'm the founder of Codecourse!
Episode discussion
No comments, yet. Be the first!