title: How to Create an anti-request forgery state token In google+ server side sign-up
body: <pre><code>    &lt;?php
       require_once '/google-api-php-client/src/Google_Client.php';
       require_once '/google-api-php-client/src/contrib/Google_PlusService.php';
  
       session_start();
       // Create a state token to prevent request forgery.
       // Store it in the session for later validation.
       $state = md5(rand());
       $app['session']-&gt;set('state', $state);
       // Set the client ID, token state, and application name in the HTML while
       // serving it.
       return $app['twig']-&gt;render('index.html', array(
        'CLIENT_ID' =&gt; CLIENT_ID,
        'STATE' =&gt; $state,
        'APPLICATION_NAME' =&gt; APPLICATION_NAME
       ));
  
        // Ensure that this is no request forgery going on, and that the user
       // sending us this connect request is the user that was supposed to.
      if ($request-&gt;get('state') != ($app['session']-&gt;get('state'))) {
      return new Response('Invalid state parameter', 401);
     }
  
  
      $code = $request-&gt;getContent();
      $gPlusId = $request-&gt;get['gplus_id'];
      // Exchange the OAuth 2.0 authorization code for user credentials.
      $client-&gt;authenticate($code);
  
      $token = json_decode($client-&gt;getAccessToken());
      // Verify the token
      $reqUrl = 'https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=' .
            $token-&gt;access_token;
      $req = new Google_HttpRequest($reqUrl);
  
      $tokenInfo = json_decode(
        $client::getIo()-&gt;authenticatedRequest($req)-&gt;getResponseBody());
  
       // If there was an error in the token info, abort.
      if ($tokenInfo-&gt;error) {
      return new Response($tokenInfo-&gt;error, 500);
      }
       // Make sure the token we got is for the intended user.
       if ($tokenInfo-&gt;userid != $gPlusId) {
        return new Response(
          "Token's user ID doesn't match given user ID", 401);
       }
      // Make sure the token we got is for our app.
      if ($tokenInfo-&gt;audience != CLIENT_ID) {
      return new Response(
          "Token's client ID does not match app's.", 401);
      }
  
      // Store the token in the session for later use.
      $app['session']-&gt;set('token', json_encode($token));
      $response = 'Succesfully connected with token: ' . print_r($token, true);
     ?&gt;
  </code></pre>
  
  <p>This is my code.php.<br>
  I have taken this code from <a href="https://developers.google.com/+/web/signin/server-side-flow" rel="nofollow">https://developers.google.com/+/web/signin/server-side-flow</a>.
  I want to add google+ server side sign-up in to my application. 
  so i decide to run the sample code. 
  I am getting the error while i have run the code.
  I have already include the  Google APIs client library for PHP.
  I am unable to use set and render function which are shown in the code</p>
  
  <pre><code>this is My index.html
  
  
      &lt;!-- The top of file index.html --&gt;
      &lt;html itemscope itemtype="http://schema.org/Article"&gt;
      &lt;head&gt;
      &lt;!-- BEGIN Pre-requisites --&gt;
      &lt;script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"&gt;
      &lt;/script&gt;
      &lt;script type="text/javascript"&gt;
       (function () {
        var po = document.createElement('script');
        po.type = 'text/javascript';
        po.async = true;
        po.src = 'https://plus.google.com/js/client:plusone.js?onload=start';
        var s = document.getElementsByTagName('script')[0];
        s.parentNode.insertBefore(po, s);
      })();
    &lt;/script&gt;
    &lt;!-- END Pre-requisites --&gt;
  &lt;/head&gt;
  &lt;!-- ... --&gt;
  &lt;/html&gt;
  
  &lt;!-- Add where you want your sign-in button to render --&gt;
  &lt;div id="signinButton"&gt;
    &lt;span class="g-signin"
      data-scope="https://www.googleapis.com/auth/plus.login"
      data-clientid="YOUR_CLIENT_ID"
      data-redirecturi="postmessage"
      data-accesstype="offline"
      data-cookiepolicy="single_host_origin"
      data-callback="signInCallback"&gt;
    &lt;/span&gt;
  &lt;/div&gt;
  &lt;div id="result"&gt;&lt;/div&gt;
  
      &lt;!-- Last part of BODY element in file index.html --&gt;
     &lt;script type="text/javascript"&gt;
  
        function signInCallback(authResult) {
        if (authResult['code']) {
  
        // Hide the sign-in button now that the user is authorized, for example:
       $('#signinButton').attr('style', 'display: none');
  
       // Send the code to the server
       $.ajax({
        type: 'POST',
        url: 'plus.php?storeToken',
        contentType: 'application/octet-stream; charset=utf-8',
        success: function(result) {
          // Handle or verify the server response if necessary.
  
          // Prints the list of people that the user has allowed the app to know
          // to the console.
          console.log(result);
          if (result['profile'] &amp;&amp; result['people']){
            $('#results').html('Hello ' + result['profile']['displayName'] + '. You successfully made a server side call to people.get and people.list');
          } else {
            $('#results').html('Failed to make a server-side call. Check your configuration and console.');
          }
        },
        processData: false,
        data: authResult['code']
      });
      }  
       else if (authResult['error']) {
        // There was an error.
        // Possible error codes:
        //   "access_denied" - User denied access to your app
        //   "immediate_failed" - Could not automatially log in the user
        // console.log('There was an error: ' + authResult['error']);
      }
      }
    &lt;/script&gt;
  </code></pre>