diff options
| author | Jeremy Mikola <jmikola@gmail.com> | 2011-12-30 00:08:04 -0500 |
|---|---|---|
| committer | Jeremy Mikola <jmikola@gmail.com> | 2012-02-14 19:03:51 -0500 |
| commit | 0924bcd2ebc4ec0ad510aea6df4034bb2e716c03 (patch) | |
| tree | b3a33dd65e5c9e834f41b892e98345e3088f4a7e /Core/Exception | |
| parent | 5b01ebf19827e03e4f4a86efd3f69e4bb4be023a (diff) | |
| download | symfony-security-0924bcd2ebc4ec0ad510aea6df4034bb2e716c03.zip symfony-security-0924bcd2ebc4ec0ad510aea6df4034bb2e716c03.tar.gz symfony-security-0924bcd2ebc4ec0ad510aea6df4034bb2e716c03.tar.bz2 | |
[Security] Allow LogoutListener to validate CSRF tokens
This adds several new options to the logout listener, modeled after the form_login listener:
* csrf_parameter
* intention
* csrf_provider
The "csrf_parameter" and "intention" have default values if omitted. By default, "csrf_provider" is empty and CSRF validation is disabled in LogoutListener (preserving BC). If a service ID is given for "csrf_provider", CSRF validation will be enabled. Invalid tokens will result in an InvalidCsrfTokenException being thrown before any logout handlers are invoked.
Diffstat (limited to 'Core/Exception')
0 files changed, 0 insertions, 0 deletions