summaryrefslogtreecommitdiffstats
path: root/Csrf/TokenStorage
diff options
context:
space:
mode:
Diffstat (limited to 'Csrf/TokenStorage')
-rw-r--r--Csrf/TokenStorage/NativeSessionTokenStorage.php123
-rw-r--r--Csrf/TokenStorage/SessionTokenStorage.php109
-rw-r--r--Csrf/TokenStorage/TokenStorageInterface.php60
3 files changed, 292 insertions, 0 deletions
diff --git a/Csrf/TokenStorage/NativeSessionTokenStorage.php b/Csrf/TokenStorage/NativeSessionTokenStorage.php
new file mode 100644
index 0000000..2620156
--- /dev/null
+++ b/Csrf/TokenStorage/NativeSessionTokenStorage.php
@@ -0,0 +1,123 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\TokenStorage;
+
+use Symfony\Component\Security\Csrf\Exception\TokenNotFoundException;
+
+/**
+ * Token storage that uses PHP's native session handling.
+ *
+ * @since 2.4
+ *
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+class NativeSessionTokenStorage implements TokenStorageInterface
+{
+ /**
+ * The namespace used to store values in the session.
+ *
+ * @var string
+ */
+ const SESSION_NAMESPACE = '_csrf';
+
+ /**
+ * @var bool
+ */
+ private $sessionStarted = false;
+
+ /**
+ * @var string
+ */
+ private $namespace;
+
+ /**
+ * Initializes the storage with a session namespace.
+ *
+ * @param string $namespace The namespace under which the token is stored
+ * in the session
+ */
+ public function __construct($namespace = self::SESSION_NAMESPACE)
+ {
+ $this->namespace = $namespace;
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function getToken($tokenId)
+ {
+ if (!$this->sessionStarted) {
+ $this->startSession();
+ }
+
+ if (!isset($_SESSION[$this->namespace][$tokenId])) {
+ throw new TokenNotFoundException('The CSRF token with ID '.$tokenId.' does not exist.');
+ }
+
+ return (string) $_SESSION[$this->namespace][$tokenId];
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function setToken($tokenId, $token)
+ {
+ if (!$this->sessionStarted) {
+ $this->startSession();
+ }
+
+ $_SESSION[$this->namespace][$tokenId] = (string) $token;
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function hasToken($tokenId)
+ {
+ if (!$this->sessionStarted) {
+ $this->startSession();
+ }
+
+ return isset($_SESSION[$this->namespace][$tokenId]);
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function removeToken($tokenId)
+ {
+ if (!$this->sessionStarted) {
+ $this->startSession();
+ }
+
+ $token = isset($_SESSION[$this->namespace][$tokenId])
+ ? (string) $_SESSION[$this->namespace][$tokenId]
+ : null;
+
+ unset($_SESSION[$this->namespace][$tokenId]);
+
+ return $token;
+ }
+
+ private function startSession()
+ {
+ if (PHP_VERSION_ID >= 50400) {
+ if (PHP_SESSION_NONE === session_status()) {
+ session_start();
+ }
+ } elseif (!session_id()) {
+ session_start();
+ }
+
+ $this->sessionStarted = true;
+ }
+}
diff --git a/Csrf/TokenStorage/SessionTokenStorage.php b/Csrf/TokenStorage/SessionTokenStorage.php
new file mode 100644
index 0000000..a6a6ea3
--- /dev/null
+++ b/Csrf/TokenStorage/SessionTokenStorage.php
@@ -0,0 +1,109 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\TokenStorage;
+
+use Symfony\Component\HttpFoundation\Session\SessionInterface;
+use Symfony\Component\Security\Csrf\Exception\TokenNotFoundException;
+
+/**
+ * Token storage that uses a Symfony2 Session object.
+ *
+ * @since 2.4
+ *
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+class SessionTokenStorage implements TokenStorageInterface
+{
+ /**
+ * The namespace used to store values in the session.
+ *
+ * @var string
+ */
+ const SESSION_NAMESPACE = '_csrf';
+
+ /**
+ * The user session from which the session ID is returned.
+ *
+ * @var SessionInterface
+ */
+ private $session;
+
+ /**
+ * @var string
+ */
+ private $namespace;
+
+ /**
+ * Initializes the storage with a Session object and a session namespace.
+ *
+ * @param SessionInterface $session The user session
+ * @param string $namespace The namespace under which the token
+ * is stored in the session
+ */
+ public function __construct(SessionInterface $session, $namespace = self::SESSION_NAMESPACE)
+ {
+ $this->session = $session;
+ $this->namespace = $namespace;
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function getToken($tokenId)
+ {
+ if (!$this->session->isStarted()) {
+ $this->session->start();
+ }
+
+ if (!$this->session->has($this->namespace.'/'.$tokenId)) {
+ throw new TokenNotFoundException('The CSRF token with ID '.$tokenId.' does not exist.');
+ }
+
+ return (string) $this->session->get($this->namespace.'/'.$tokenId);
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function setToken($tokenId, $token)
+ {
+ if (!$this->session->isStarted()) {
+ $this->session->start();
+ }
+
+ $this->session->set($this->namespace.'/'.$tokenId, (string) $token);
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function hasToken($tokenId)
+ {
+ if (!$this->session->isStarted()) {
+ $this->session->start();
+ }
+
+ return $this->session->has($this->namespace.'/'.$tokenId);
+ }
+
+ /**
+ * {@inheritdoc}
+ */
+ public function removeToken($tokenId)
+ {
+ if (!$this->session->isStarted()) {
+ $this->session->start();
+ }
+
+ return $this->session->remove($this->namespace.'/'.$tokenId);
+ }
+}
diff --git a/Csrf/TokenStorage/TokenStorageInterface.php b/Csrf/TokenStorage/TokenStorageInterface.php
new file mode 100644
index 0000000..5efe72f
--- /dev/null
+++ b/Csrf/TokenStorage/TokenStorageInterface.php
@@ -0,0 +1,60 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Csrf\TokenStorage;
+
+/**
+ * Stores CSRF tokens.
+ *
+ * @since 2.4
+ *
+ * @author Bernhard Schussek <bschussek@gmail.com>
+ */
+interface TokenStorageInterface
+{
+ /**
+ * Reads a stored CSRF token.
+ *
+ * @param string $tokenId The token ID
+ *
+ * @return string The stored token
+ *
+ * @throws \Symfony\Component\Security\Csrf\Exception\TokenNotFoundException If the token ID does not exist
+ */
+ public function getToken($tokenId);
+
+ /**
+ * Stores a CSRF token.
+ *
+ * @param string $tokenId The token ID
+ * @param string $token The CSRF token
+ */
+ public function setToken($tokenId, $token);
+
+ /**
+ * Removes a CSRF token.
+ *
+ * @param string $tokenId The token ID
+ *
+ * @return string|null Returns the removed token if one existed, NULL
+ * otherwise
+ */
+ public function removeToken($tokenId);
+
+ /**
+ * Checks whether a token with the given token ID exists.
+ *
+ * @param string $tokenId The token ID
+ *
+ * @return bool Whether a token exists with the given ID
+ */
+ public function hasToken($tokenId);
+}
generated by cgit v1.1 at 2025-05-12 15:17:53 +0000