[Security] Use the session only if it is started when using SameOriginCsrfTokenManager
#59146
Conversation
|
Hey! I see that this is your first PR. That is great! Welcome! Symfony has a contribution guide which I suggest you to read. In short:
Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change. When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor! I am going to sit back now and wait for the reviews. Cheers! Carsonbot |
SameOriginCsrfTokenManagerSameOriginCsrfTokenManager
|
Hey! Thanks for your PR. You are targeting branch "7.3" but it seems your PR description refers to branch "7.2". Cheers! Carsonbot |
|
Maybe you could you take a look @nicolas-grekas ? 🙏 |
…inCsrfTokenManager`
SameOriginCsrfTokenManagerSameOriginCsrfTokenManager
28ff65d to
1327e38
Compare
|
Thanks ! |
|
Thank you @Crovitche-1623. |
If I understand well, the
SameOriginCsrfTokenManagerhas been created to provide a stateless way of creating CSRF tokens and therefore allow pages with CSRF tokens to be cached.When using
Symfony\Component\Security\Csrf\SameOriginCsrfTokenManager, I think an additionnal check must be done to ensure that the session is started in addition to verifying that it exists. If not, the CSRF strategy used will be persisted everytime in the session and the stateless check (used with the#[Route]attribute parameter) will therefore never pass.