src/Core/EventSubscriber/CsrfCookieSubscriber.php line 92

Open in your IDE?
  1. <?php
  3. namespace App\Core\EventSubscriber;
  5. use App\Core\FeatureFlag\FeatureFlagEnum;
  6. use App\Core\FeatureFlag\FeatureFlagRepository;
  7. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  8. use Symfony\Component\HttpFoundation\Cookie;
  9. use Symfony\Component\HttpKernel\Event\ControllerEvent;
  10. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  11. use Symfony\Component\HttpKernel\KernelEvents;
  12. use Symfony\Component\Security\Core\Exception\AccessDeniedException;
  13. use Symfony\Component\Security\Core\Security;
  14. use Symfony\Component\Security\Csrf\CsrfToken;
  15. use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
  17. class CsrfCookieSubscriber implements EventSubscriberInterface
  18. {
  19.     private const COOKIE_NAME = 'csrf_token';
  20.     private const FIREWALL_BACKOFFICE = 'security.firewall.map.context.backoffice';
  21.     private const FIREWALL_MAIN = 'security.firewall.map.context.main';
  23.     public function __construct(
  24.         private readonly CsrfTokenManagerInterface $tokenManager,
  25.         private readonly FeatureFlagRepository     $featureFlagRepository,
  26.         private readonly Security                  $security,
  27.         private readonly string                    $environment
  28.     ) {
  29.     }
  31.     public static function getSubscribedEvents(): array
  32.     {
  33.         return [
  34.             KernelEvents::RESPONSE => ['onKernelResponse', -5], // After security listeners, before profiling
  35.             KernelEvents::CONTROLLER => ['onKernelController', -20], // After CsrfProtectedListener (-10)
  36.         ];
  37.     }
  39.     public function onKernelResponse(ResponseEvent $event): void
  40.     {
  41.         if (in_array($this->environment, ['test', 'phpunit'], true)) {
  42.             return;
  43.         }
  45.         if (!$this->featureFlagRepository->isFeatureEnabled(FeatureFlagEnum::CSRF_COOKIE)) {
  46.             return;
  47.         }
  49.         if (!$event->isMasterRequest()) {
  50.             return;
  51.         }
  53.         $request = $event->getRequest();
  55.         $firewallContext = $request->attributes->get('_firewall_context');
  57.         if (!$request->hasSession() ||
  58.             !($firewallContext === self::FIREWALL_MAIN ||
  59.                 $firewallContext === self::FIREWALL_BACKOFFICE
  60.             )
  61.         ) {
  62.             return;
  63.         }
  65.         // Only set cookie for authenticated users (not anonymous)
  66.         if (null === $this->security->getToken() || !$this->security->isGranted('IS_AUTHENTICATED_FULLY')) {
  67.             return;
  68.         }
  70.         $csrfToken = $this->tokenManager->getToken('app')->getValue();
  72.         if ($request->cookies->get(self::COOKIE_NAME) === $csrfToken) {
  73.             return;
  74.         }
  76.         $cookie = new Cookie(
  77.             name: self::COOKIE_NAME,
  78.             value: $csrfToken,
  79.             expire: 0,
  80.             path: '/web-api',
  81.             domain: null,
  82.             secure: true,
  83.             httpOnly: true,
  84.             raw: false,
  85.             sameSite: Cookie::SAMESITE_LAX
  86.         );
  88.         $response = $event->getResponse();
  89.         $response->headers->setCookie($cookie);
  90.     }
  92.     public function onKernelController(ControllerEvent $event): void
  93.     {
  94.         if (in_array($this->environment, ['test', 'phpunit'], true)) {
  95.             return;
  96.         }
  98.         if (!$this->featureFlagRepository->isFeatureEnabled(FeatureFlagEnum::CSRF_COOKIE)) {
  99.             return;
  100.         }
  102.         $request = $event->getRequest();
  104.         $firewallContext = $request->attributes->get('_firewall_context');
  106.         if (!$request->hasSession() ||
  107.             !($firewallContext === self::FIREWALL_MAIN ||
  108.                 $firewallContext === self::FIREWALL_BACKOFFICE
  109.             )
  110.         ) {
  111.             return;
  112.         }
  114.         // Only validate CSRF for authenticated users (not anonymous)
  115.         if (!$this->security->isGranted('IS_AUTHENTICATED_FULLY')) {
  116.             return;
  117.         }
  119.         /** @var string $cookieToken */
  120.         $cookieToken = $request->cookies->get(self::COOKIE_NAME);
  122.         // If cookie doesn't exist yet, skip validation (first request - cookie will be created in response)
  123.         if (!$cookieToken) {
  124.             return;
  125.         }
  127.         $csrfToken = new CsrfToken('app', $cookieToken);
  128.         if (!$this->tokenManager->isTokenValid($csrfToken)) {
  129.             throw new AccessDeniedException('CSRF: Invalid token');
  130.         }
  131.     }
  132. }