[Security] Use LogoutException for invalid CSRF token in LogoutListener

On the advice of @schmittjoh, this commit adds a LogoutException class for use by LogoutListener if the CSRF token is invalid. The handling in the Security component's ExceptionListener is modeled after AccessDeniedException, which gets wrapped in an AccessDeniedHttpException in the absence of handler service or error page (I didn't think it was appropriate to re-use those for LogoutException).
symfony · fabpot · Mar 5, 2012 · Dec 31, 2011 · Dec 29, 2011 · Dec 30, 2011
commit 49a8654cb8074f648cd13060a2b85ccd2f136c75
diff --git a/src/Symfony/Component/Security/Core/Exception/LogoutException.php b/src/Symfony/Component/Security/Core/Exception/LogoutException.php
@@ -0,0 +1,25 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Exception;
+
+/**
+ * LogoutException is thrown when the account cannot be logged out.
+ *
+ * @author Jeremy Mikola <jmikola@gmail.com>
+ */
+class LogoutException extends \RuntimeException
+{
+    public function __construct($message = 'Logout Exception', \Exception $previous = null)
+    {
+        parent::__construct($message, 403, $previous);
+    }
+}
diff --git a/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php b/src/Symfony/Component/Security/Http/Firewall/ExceptionListener.php
@@ -20,6 +20,7 @@
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 use Symfony\Component\Security\Core\Exception\InsufficientAuthenticationException;
+use Symfony\Component\Security\Core\Exception\LogoutException;
 use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Log\LoggerInterface;
@@ -140,6 +141,14 @@ public function onKernelException(GetResponseForExceptionEvent $event)
                     return;
                 }
             }
+        } elseif ($exception instanceof LogoutException) {
+            if (null !== $this->logger) {
+                $this->logger->info(sprintf('Logout exception occurred; wrapping with AccessDeniedHttpException (%s)', $exception->getMessage()));
+            }
+
+            $event->setException(new AccessDeniedHttpException($exception->getMessage(), $exception));
+
+            return;
         } else {
             return;
         }

diff --git a/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php b/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php
@@ -16,7 +16,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\Security\Core\SecurityContextInterface;
-use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
+use Symfony\Component\Security\Core\Exception\LogoutException;
 use Symfony\Component\Security\Http\HttpUtils;
 use Symfony\Component\Security\Http\Logout\LogoutHandlerInterface;
 use Symfony\Component\Security\Http\Logout\LogoutSuccessHandlerInterface;
@@ -91,7 +91,7 @@ public function handle(GetResponseEvent $event)
             $csrfToken = $request->get($this->options['csrf_parameter'], null, true);
 
             if (false === $this->csrfProvider->isCsrfTokenValid($this->options['intention'], $csrfToken)) {
-                throw new InvalidCsrfTokenException('Invalid CSRF token.');
+                throw new LogoutException('Invalid CSRF token.');
             }
         }
 

diff --git a/tests/Symfony/Tests/Component/Security/Http/Firewall/LogoutListenerTest.php b/tests/Symfony/Tests/Component/Security/Http/Firewall/LogoutListenerTest.php
@@ -145,7 +145,7 @@ public function testSuccessHandlerReturnsNonResponse()
     }
 
     /**
-     * @expectedException Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException
+     * @expectedException Symfony\Component\Security\Core\Exception\LogoutException
      */
     public function testCsrfValidationFails()
     {
-Original file line number
+Diff line change
@@ Expand Up / @@ -145,7 +145,7 @@ public function testSuccessHandlerReturnsNonResponse() @@
         }
         /**
-         * @expectedException Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException
+         * @expectedException Symfony\Component\Security\Core\Exception\LogoutException
          */
         public function testCsrfValidationFails()
         {
@@ Expand Down @@