[SecurityBundle] Add shortcut option to enable logout CSRF protection

wouterj · wouterj · commit 568d1c431ab6 · 2022-06-04T12:48:04.000+02:00
diff --git a/src/Symfony/Bundle/SecurityBundle/CHANGELOG.md b/src/Symfony/Bundle/SecurityBundle/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+6.2
+---
+
+ * Add `security.firewalls.logout.enable_csrf` to enable CSRF protection using the default CSRF token generator
+
 6.1
 ---
 
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/MainConfiguration.php
@@ -210,10 +210,23 @@ private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $facto
             ->arrayNode('logout')
                 ->treatTrueLike([])
                 ->canBeUnset()
+                ->beforeNormalization()
+                    ->ifTrue(fn ($v): bool => is_array($v) && (isset($v['csrf_token_generator']) xor isset($v['enable_csrf'])))
+                    ->then(function (array $v): array {
+                        if (isset($v['csrf_token_generator'])) {
+                            $v['enable_csrf'] = true;
+                        } elseif ($v['enable_csrf']) {
+                            $v['csrf_token_generator'] = 'security.csrf.token_generator';
+                        }
+
+                        return $v;
+                    })
+                ->end()
                 ->children()
-                    ->scalarNode('csrf_parameter')->defaultValue('_csrf_token')->end()
-                    ->scalarNode('csrf_token_generator')->cannotBeEmpty()->end()
+                    ->booleanNode('enable_csrf')->defaultNull()->end()
                     ->scalarNode('csrf_token_id')->defaultValue('logout')->end()
+                    ->scalarNode('csrf_parameter')->defaultValue('_csrf_token')->end()
+                    ->scalarNode('csrf_token_generator')->end()
                     ->scalarNode('path')->defaultValue('/logout')->end()
                     ->scalarNode('target')->defaultValue('/')->end()
                     ->booleanNode('invalidate_session')->defaultTrue()->end()
diff --git a/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php b/src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php
@@ -406,7 +406,7 @@ private function createFirewall(ContainerBuilder $container, string $id, array $
                 ->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);
 
             // add CSRF provider
-            if (isset($firewall['logout']['csrf_token_generator'])) {
+            if ($firewall['logout']['enable_csrf']) {
                 $logoutListener->addArgument(new Reference($firewall['logout']['csrf_token_generator']));
             }
 
diff --git a/src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php b/src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/MainConfigurationTest.php
@@ -88,6 +88,55 @@ public function testCsrfAliases()
         $this->assertEquals('a_token_id', $processedConfig['firewalls']['stub']['logout']['csrf_token_id']);
     }
 
+    public function testLogoutCsrf()
+    {
+        $config = [
+            'firewalls' => [
+                'custom_token_generator' => [
+                    'logout' => [
+                        'csrf_token_generator' => 'a_token_generator',
+                        'csrf_token_id' => 'a_token_id',
+                    ],
+                ],
+                'default_token_generator' => [
+                    'logout' => [
+                        'enable_csrf' => true,
+                        'csrf_token_id' => 'a_token_id',
+                    ],
+                ],
+                'disabled_csrf' => [
+                    'logout' => [
+                        'enable_csrf' => false,
+                    ],
+                ],
+                'empty' => [
+                    'logout' => true,
+                ],
+            ],
+        ];
+        $config = array_merge(static::$minimalConfig, $config);
+
+        $processor = new Processor();
+        $configuration = new MainConfiguration([], []);
+        $processedConfig = $processor->processConfiguration($configuration, [$config]);
+
+        $assertions = [
+            'custom_token_generator' => [true, 'a_token_generator'],
+            'default_token_generator' => [true, 'security.csrf.token_generator'],
+            'disabled_csrf' => [false, null],
+            'empty' => [false, null],
+        ];
+        foreach ($assertions as $firewallName => [$enabled, $tokenGenerator]) {
+            $this->assertEquals($enabled, $processedConfig['firewalls'][$firewallName]['logout']['enable_csrf']);
+            if ($tokenGenerator) {
+                $this->assertEquals($tokenGenerator, $processedConfig['firewalls'][$firewallName]['logout']['csrf_token_generator']);
+                $this->assertEquals('a_token_id', $processedConfig['firewalls'][$firewallName]['logout']['csrf_token_id']);
+            } else {
+                $this->assertArrayNotHasKey('csrf_token_generator', $processedConfig['firewalls'][$firewallName]['logout']);
+            }
+        }
+    }
+
     public function testDefaultUserCheckers()
     {
         $processor = new Processor();

Original file line number	Diff line number	Diff line change
`@@ -406,7 +406,7 @@ private function createFirewall(ContainerBuilder $container, string $id, array $`
`406`	`406`	`->addTag('kernel.event_subscriber', ['dispatcher' => $firewallEventDispatcherId]);`
`407`	`407`
`408`	`408`	`// add CSRF provider`
`409`		`- if (isset($firewall['logout']['csrf_token_generator'])) {`
	`409`	`+ if ($firewall['logout']['enable_csrf']) {`
`410`	`410`	`$logoutListener->addArgument(new Reference($firewall['logout']['csrf_token_generator']));`
`411`	`411`	`}`
`412`	`412`