Security

Rhapsody is built with security in mind and includes several features to protect your application from common vulnerabilities.

CSRF Protection

Cross-Site Request Forgery (CSRF) attacks trick users into performing unwanted actions. Rhapsody makes protection easy.

The VerifyCsrfTokenMiddleware runs globally on every request. It automatically validates CSRF tokens for all POST requests (and other “unsafe” methods like PUT, PATCH, DELETE). If the token is missing or invalid, the request is aborted with a 419 Page Expired error.

Adding the CSRF Token to Forms

Include the csrf_field() Twig function inside every form that submits with method="POST" (or uses a spoofed method). This generates a hidden input containing the user’s unique token.

<form action="/profile/update" method="POST">
    
    <!-- other fields -->
    <button type="submit">Update Profile</button>
</form>

CSRF for JSON APIs

For JSON requests, include the token in the request body under the key _token. The middleware intelligently looks for the token in both $_POST and the parsed JSON payload.

{
    "_token": "generated_token_here",
    "name": "John Doe"
}

CSRF Global Middleware

The VerifyCsrfTokenMiddleware is included in the global array in config/middleware.php. It runs automatically on every matched request. You can add your own global middleware there as well.

Excluding URIs from CSRF Verification

You can exclude certain URIs (e.g., webhooks) by editing the $except array in app/Middleware/VerifyCsrfTokenMiddleware.php. Wildcards (*) are supported.

Password Hashing

The framework uses PHP's native password_hash() and password_verify() for all user authentication. Passwords are never stored in plain text and are protected with a modern, secure hashing algorithm. See app/Models/User.php and app/Controllers/AuthController.php for implementation details.