Skip to content
Corex

ChallengeContext

Corex\Security\ChallengeContext · class · Core layer

The server-known facts a challenge is judged against. Every field here is derived from stored configuration and the current request environment, never from the submitted token or any client-supplied value. That is the whole point: the expected action and the allowed hostnames are the server’s expectations, so a browser cannot declare its own action and have it believed.

Public API

Section titled “Public API”

__construct(string $expectedAction, float $threshold, array $allowedHostnames, ?string $remoteIp)

Section titled “__construct(string $expectedAction, float $threshold, array $allowedHostnames, ?string $remoteIp)”