public function CsrfAccessCheck::access in Drupal 10
Same name and namespace in other branches
- 8 core/lib/Drupal/Core/Access/CsrfAccessCheck.php \Drupal\Core\Access\CsrfAccessCheck::access()
- 9 core/lib/Drupal/Core/Access/CsrfAccessCheck.php \Drupal\Core\Access\CsrfAccessCheck::access()
Checks access based on a CSRF token for the request.
Parameters
\Symfony\Component\Routing\Route $route: The route to check against.
\Symfony\Component\HttpFoundation\Request $request: The request object.
\Drupal\Core\Routing\RouteMatchInterface $route_match: The route match object.
Return value
\Drupal\Core\Access\AccessResultInterface The access result.
File
- core/
lib/ Drupal/ Core/ Access/ CsrfAccessCheck.php, line 49
Class
- CsrfAccessCheck
- Allows access to routes to be controlled by a '_csrf_token' parameter.
Namespace
Drupal\Core\AccessCode
public function access(Route $route, Request $request, RouteMatchInterface $route_match) {
$parameters = $route_match
->getRawParameters();
$path = ltrim($route
->getPath(), '/');
// Replace the path parameters with values from the parameters array.
foreach ($parameters as $param => $value) {
$path = str_replace("{{$param}}", $value, $path);
}
if ($this->csrfToken
->validate($request->query
->get('token', ''), $path)) {
$result = AccessResult::allowed();
}
else {
$result = AccessResult::forbidden($request->query
->has('token') ? "'csrf_token' URL query argument is invalid." : "'csrf_token' URL query argument is missing.");
}
// Not cacheable because the CSRF token is highly dynamic.
return $result
->setCacheMaxAge(0);
}