Fix HMAC CSRF token payload

[samdark]

• change HMAC CSRF tokens so the emitted payload contains expiration only, while the HMAC remains bound to the current identity
• stop exposing the default session identity in decoded token payloads
• update OWASP CSRF cheat sheet terminology/link and clarify HMAC token replay semantics

Fixes #32.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: e191aa97-ec6d-4071-b230-56ec426d98bc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-32-update-csrf-docs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This pull request updates the stateless HMAC CSRF token format so the emitted payload no longer exposes the session identity and instead carries only expiration metadata plus random data, while keeping the signature bound to the current identity. It also refreshes OWASP CSRF cheat-sheet wording/links and adds tests covering the new token semantics.

Changes:

• Reworked HmacCsrfToken so token payload = {expiration}~{random} and the HMAC is computed using a session-bound identity without embedding it in the payload.
• Added tests to ensure token values change per call and that decoded payloads do not contain the session identity.
• Updated README/CHANGELOG to reflect the revised “HMAC signed token” terminology and OWASP link/semantics.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/Hmac/HmacCsrfToken.php	Changes HMAC token encoding/validation to avoid exposing identity and to include random payload + expiration.
tests/Hmac/HmacCsrfTokenTest.php	Adds coverage for non-deterministic token values and verifying identity is not present in decoded payloads.
README.md	Updates documentation terminology, OWASP link anchor, and clarifies replay semantics.
CHANGELOG.md	Notes the bug fix for #32 and documentation update.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (caab619) to head (eff25e5).

Additional details and impacted files

@@             Coverage Diff             @@
##              master       #91   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity        72        74    +2     
===========================================
  Files             10        10           
  Lines            196       196           
===========================================
  Hits             196       196           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.