Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 25026b3

Browse filesBrowse files
fabpotfabpot
committed
bug #48341 [SecurityBundle] Fix logout.csrf_token_generator default value (MatTheCat)
This PR was merged into the 6.2 branch. Discussion ---------- [SecurityBundle] Fix `logout.csrf_token_generator` default value | Q | A | ------------- | --- | Branch? | 6.2 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #48339 | License | MIT | Doc PR | N/A The token **manager** service ID configuration node is called <code>csrf_token_**generator**</code>. As such it has been wrongly assumed in #46580 `security.csrf.token_generator` was a good default value, whereas `security.csrf.token_manager` should be used (this is reflected by [the documentation](https://symfony.com/doc/current/reference/configuration/security.html#csrf-token-generator)). `csrf_token_generator` should ideally be deprecated and renamed `csrf_token_manager`. Commits ------- df539e2 [SecurityBundle] Fix `logout.csrf_token_generator` default value
2 parents fc0f8da + df539e2 commit 25026b3
Copy full SHA for 25026b3

File tree

4 files changed

+40
-2
lines changed
Filter options

4 files changed

+40
-2
lines changed

‎src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
222222
if (isset($v['csrf_token_generator'])) {
223223
$v['enable_csrf'] = true;
224224
} elseif ($v['enable_csrf']) {
225-
$v['csrf_token_generator'] = 'security.csrf.token_generator';
225+
$v['csrf_token_generator'] = 'security.csrf.token_manager';
226226
}
227227

228228
return $v;

‎src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ public function testLogoutCsrf()
122122

123123
$assertions = [
124124
'custom_token_generator' => [true, 'a_token_generator'],
125-
'default_token_generator' => [true, 'security.csrf.token_generator'],
125+
'default_token_generator' => [true, 'security.csrf.token_manager'],
126126
'disabled_csrf' => [false, null],
127127
'empty' => [false, null],
128128
];

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/Functional/LogoutTest.php
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,19 @@ public function testCookieClearingOnLogout()
6969
$this->assertNull($cookieJar->get('flavor'));
7070
}
7171

72+
public function testEnabledCsrf()
73+
{
74+
$client = $this->createClient(['test_case' => 'Logout', 'root_config' => 'config_csrf_enabled.yml']);
75+
76+
$cookieJar = $client->getCookieJar();
77+
$cookieJar->set(new Cookie('flavor', 'chocolate', strtotime('+1 day'), null, 'somedomain'));
78+
79+
$client->request('POST', '/login', ['_username' => 'johannes', '_password' => 'test']);
80+
$client->request('GET', '/logout');
81+
82+
$this->assertResponseStatusCodeSame(Response::HTTP_FORBIDDEN);
83+
}
84+
7285
private function callInRequestContext(KernelBrowser $client, callable $callable): void
7386
{
7487
/** @var EventDispatcherInterface $eventDispatcher */

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Logout/config_csrf_enabled.yml

Copy file name to clipboard
+25Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
imports:
2+
- { resource: ./../config/framework.yml }
3+
4+
security:
5+
password_hashers:
6+
Symfony\Component\Security\Core\User\InMemoryUser: plaintext
7+
8+
providers:
9+
in_memory:
10+
memory:
11+
users:
12+
johannes: { password: test, roles: [ROLE_USER] }
13+
14+
firewalls:
15+
default:
16+
form_login:
17+
check_path: login
18+
remember_me: true
19+
require_previous_session: false
20+
logout:
21+
enable_csrf: true
22+
23+
access_control:
24+
- { path: ^/login$, roles: IS_AUTHENTICATED_ANONYMOUSLY }
25+
- { path: .*, roles: IS_AUTHENTICATED_FULLY }

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.