Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[Security] Add support for dynamic CSRF id with Expression in#[IsCsrfTokenValid]#54443
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
[Security] Add support for dynamic CSRF id with Expression in#[IsCsrfTokenValid]#54443
Uh oh!
There was an error while loading.Please reload this page.
Conversation
src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.phpShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
src/Symfony/Component/Security/Http/Attribute/IsCsrfTokenValid.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
94noni commentedMar 30, 2024
will this works with for example an object in the controller action ? Expression (delete item « post.slug ») |
e40a7e1 toa9643cbCompareyguedidi commentedMar 30, 2024
@94noni yes it should as it used the ExpressionLanguage component, like in |
src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
smnandre commentedMar 30, 2024
I'm curious what is the problem this scenario help to solve ? You still have to write manually this id on the template right ? |
yguedidi commentedMar 30, 2024
@smnandre it's for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following: {# in a loop over multiple posts#}<formaction="{{ path('post_delete', {post:post.id}) }}"method="POST"> <inputtype="hidden"name="_token"value="{{ csrf_token('delete-post-'~post.id) }}"> ...</form> |
...ymfony/Component/Security/Http/Tests/EventListener/IsCsrfTokenValidAttributeListenerTest.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
a9643cb to6858285Compare
stof left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
The code snippet in the description is also wrong. Accessing a key in an array will beargs["post"], notargs.post. In ExpressionLanguage, the. operator is a strict equivalent of the-> operator in PHP. It does not have the Twig magic.
src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
yguedidi commentedMar 31, 2024
good catch! was written from memory without checking, thank you, description updated |
src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/RegisterCsrfFeaturesPass.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
#[IsCsrfTokenValid]#[IsCsrfTokenValid]4dc452b to7db4866Comparesrc/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php OutdatedShow resolvedHide resolved
Uh oh!
There was an error while loading.Please reload this page.
7db4866 toc09c734Comparec09c734 to8f99ca5Comparenicolas-grekas commentedApr 5, 2024
Thank you@yguedidi. |
Uh oh!
There was an error while loading.Please reload this page.
Use case is for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following:
The new feature will allow:
Maybe this need more tests but need help identify which test cases are useful.
Hope this can pass before the feature freeze