8000 [Security] Use LogoutException for invalid CSRF token in LogoutListener · symfony/symfony@49a8654 · GitHub
[go: up one dir, main page]
Skip to content

Commit 49a8654

Browse files
jmikolajmikola
committed
[Security] Use LogoutException for invalid CSRF token in LogoutListener
On the advice of @schmittjoh, this commit adds a LogoutException class for use by LogoutListener if the CSRF token is invalid. The handling in the Security component's ExceptionListener is modeled after AccessDeniedException, which gets wrapped in an AccessDeniedHttpException in the absence of handler service or error page (I didn't think it was appropriate to re-use those for LogoutException).
1 parent a96105e commit 49a8654

File tree

4 files changed

+37
-3
lines changed

4 files changed

+37
-3
lines changed

‎src/Symfony/Component/Security/Core/Exception/LogoutException.php

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Component\Security\Core\Exception;
13+
14+
/**
15+
* LogoutException is thrown when the account cannot be logged out.
16+
*
17+
* @author Jeremy Mikola <jmikola@gmail.com>
18+
*/
19+
class LogoutException extends \RuntimeException
20+
{
21+
public function __construct($message = 'Logout Exception', \Exception $previous = null)
22+
{
23+
parent::__construct($message, 403, $previous);
24+
}
25+
}

‎src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
use Symfony\Component\Security\Core\Exception\AuthenticationException;
2121
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
2222
use Symfony\Component\Security\Core\Exception\InsufficientAuthenticationException;
23+
use Symfony\Component\Security\Core\Exception\LogoutException;
2324
use Symfony\Component\Security\Http\HttpUtils;
2425
use Symfony\Component\HttpFoundation\Request;
2526
use Symfony\Component\HttpKernel\Log\LoggerInterface;
@@ -140,6 +141,14 @@ public function onKernelException(GetResponseForExceptionEvent $event)
140141
return;
141142
}
142143
}
144+
} elseif ($exception instanceof LogoutException) {
145+
if (null !== $this->logger) {
146+
$this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
147+
}
148+
149+
$event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
150+
151+
return;
143152
} else {
144153
return;
145154
}

‎src/Symfony/Component/Security/Http/Firewall/LogoutListener.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
use Symfony\Component\HttpFoundation\Response;
1717
use Symfony\Component\HttpKernel\Event\GetResponseEvent;
1818
use Symfony\Component\Security\Core\SecurityContextInterface;
19-
use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
19+
use Symfony\Component\Security\Core\Exception\LogoutException;
2020
use Symfony\Component\Security\Http\HttpUtils;
2121
use Symfony\Component\Security\Http\Logout\LogoutHandlerInterface;
2222
use Symfony\Component\Security\Http\Logout\LogoutSuccessHandlerInterface;
@@ -91,7 +91,7 @@ public function handle(GetResponseEvent $event)
9191
$csrfToken = $request->get($this->options['csrf_parameter'], null, true);
9292

9393
if (false === $this->csrfProvider->isCsrfTokenValid($this->options['intention'], $csrfToken)) {
94-
throw new InvalidCsrfTokenException('Invalid CSRF token.');
94+
throw new LogoutException('Invalid CSRF token.');
9595
}
9696
}
9797

‎tests/Symfony/Tests/Component/Security/Http/Firewall/LogoutListenerTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ public function testSuccessHandlerReturnsNonResponse()
145145
}
146146

147147
/**
148-
* @expectedException Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException
148+
* @expectedException Symfony\Component\Security\Core\Exception\LogoutException
149149
*/
150150
public function testCsrfValidationFails()
151151
{

0 commit comments

Comments
 (0)
0