public function CsrfAccessCheck::access in Drupal 9

Same name and namespace in other branches

1. 8 core/lib/Drupal/Core/Access/CsrfAccessCheck.php \Drupal\Core\Access\CsrfAccessCheck::access()

Checks access based on a CSRF token for the request.

Parameters

\Symfony\Component\Routing\Route $route: The route to check against.

\Symfony\Component\HttpFoundation\Request $request: The request object.

\Drupal\Core\Routing\RouteMatchInterface $route_match: The route match object.

Return value

\Drupal\Core\Access\AccessResultInterface The access result.

File

core/lib/Drupal/Core/Access/CsrfAccessCheck.php, line 49

Class

CsrfAccessCheck

Allows access to routes to be controlled by a '_csrf_token' parameter.

Namespace

Drupal\Core\Access

Code

public function access(Route $route, Request $request, RouteMatchInterface $route_match) {
  $parameters = $route_match
    ->getRawParameters();
  $path = ltrim($route
    ->getPath(), '/');

  // Replace the path parameters with values from the parameters array.
  foreach ($parameters as $param => $value) {
    $path = str_replace("{{$param}}", $value, $path);
  }
  if ($this->csrfToken
    ->validate($request->query
    ->get('token', ''), $path)) {
    $result = AccessResult::allowed();
  }
  else {
    $result = AccessResult::forbidden($request->query
      ->has('token') ? "'csrf_token' URL query argument is invalid." : "'csrf_token' URL query argument is missing.");
  }

  // Not cacheable because the CSRF token is highly dynamic.
  return $result
    ->setCacheMaxAge(0);
}