[Security] Add support for dynamic CSRF id with Expression in `#[IsCsrfTokenValid]` #54443

yguedidi · 2024-03-30T17:08:58Z

Q	A
Branch?	7.1
Bug fix?	no
New feature?	yes
Deprecations?	no
Issues	continuation of #52961 from Hackday
License	MIT

Use case is for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following:

{# in a loop over multiple posts #}
<form action="{{ path('post_delete', {post: post.id}) }}" method="POST">
    <input type="hidden" name="_token" value="{{ csrf_token('delete-post-' ~ post.id) }}">
    ...
</form>

The new feature will allow:

#[IsCsrfTokenValid(new Expression('"delete-post-" ~ args["post"].id'))]
public function delete(Request $request, Post $post): Response
{
    // ... delete the post
}

Maybe this need more tests but need help identify which test cases are useful.
Hope this can pass before the feature freeze

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php

src/Symfony/Component/Security/Http/Attribute/IsCsrfTokenValid.php

94noni · 2024-03-30T19:45:41Z

will this works with for example an object in the controller action ?

Expression (delete item « post.slug »)
__invoke(Post $post)

yguedidi · 2024-03-30T20:38:29Z

will this works with for example an object in the controller action ?

@94noni yes it should as it used the ExpressionLanguage component, like in IsGranted you can set subject="post.author"

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php

smnandre · 2024-03-30T20:56:18Z

I'm curious what is the problem this scenario help to solve ? You still have to write manually this id on the template right ?

yguedidi · 2024-03-30T21:09:04Z

I'm curious what is the problem this scenario help to solve ? You still have to write manually this id on the template right ?

@smnandre it's for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following:

{# in a loop over multiple posts #}
<form action="{{ path('post_delete', {post: post.id}) }}" method="POST">
    <input type="hidden" name="_token" value="{{ csrf_token('delete-post-' ~ post.id) }}">
    ...
</form>

...ymfony/Component/Security/Http/Tests/EventListener/IsCsrfTokenValidAttributeListenerTest.php

stof

The code snippet in the description is also wrong. Accessing a key in an array will be args["post"], not args.post. In ExpressionLanguage, the . operator is a strict equivalent of the -> operator in PHP. It does not have the Twig magic.

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php

yguedidi · 2024-03-31T16:42:48Z

The code snippet in the description is also wrong. Accessing a key in an array will be args["post"], not args.post. In ExpressionLanguage, the . operator is a strict equivalent of the -> operator in PHP. It does not have the Twig magic.

good catch! was written from memory without checking, thank you, description updated

src/Symfony/Bundle/SecurityBundle/DependencyInjection/Compiler/RegisterCsrfFeaturesPass.php

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php

nicolas-grekas · 2024-04-05T09:34:05Z

Thank you @yguedidi.

yguedidi requested a review from chalasr as a code owner March 30, 2024 17:08

carsonbot added Status: Needs Review Feature labels Mar 30, 2024

carsonbot added this to the 7.1 milestone Mar 30, 2024

smnandre reviewed Mar 30, 2024

View reviewed changes

src/Symfony/Component/Security/Http/EventListener/IsCsrfTokenValidAttributeListener.php Show resolved Hide resolved

smnandre reviewed Mar 30, 2024

View reviewed changes

src/Symfony/Component/Security/Http/Attribute/IsCsrfTokenValid.php Outdated Show resolved Hide resolved

yguedidi force-pushed the add-support-for-dynamic-csrf-id-in-iscsrftokenvalid branch from e40a7e1 to a9643cb Compare March 30, 2024 20:35

yguedidi requested a review from smnandre March 30, 2024 20:38

smnandre reviewed Mar 30, 2024

View reviewed changes