O Guia Definitivo do Yii 1.1

eturn array(
'components'=>array(
'request'=>array(
'enableCsrfValidation'=>true,
),
),
);
And to display a form, call CHtml::form instead of writing the HTML form tag directly. The
CHtml::form method will embed the necessary random value in a hidden field so that it can
be submitted for CSRF validation.
Cookie Attack Prevention
Protecting cookies from being attacked is of extreme importance, as session IDs are
commonly stored in cookies. If one gets hold of a session ID, he essentially owns all
relevant session information.
There are several countermeasures to prevent cookies from being attacked.
• An application can use SSL to create a secure communication channel and only pass
the authentication cookie over an HTTPS connection. Attackers are thus unable to
decipher the contents in the transferred cookies.
• Expire sessions appropriately, including all cookies and session tokens, to reduce the
likelihood of being attacked.
• Prevent cross-site scripting which causes arbitrary code to run in a user's browser
and expose his cookies.
• Validate cookie data and detect if they are altered.
Yii implements a cookie validation scheme that prevents cookies from being modified. In
particular, it does HMAC check for the cookie values if cookie validation is enabled.
Cookie validation is disabled by default. To enable it, configure the CHttpRequest
application component in the application configuration as follows,
return array(
'components'=>array(
'request'=>array(
'enableCookieValidation'=>true,
),
),
);
To make use of the cookie validation scheme provided by Yii, we also need to access
cookies through the cookies collection, instead of directly through $_COOKIES: