public function CsrfRequestHeaderAccessCheck::applies in Drupal 10

Same name and namespace in other branches

1. 8 core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::applies()
2. 9 core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::applies()

Declares whether the access check applies to a specific route or not.

Parameters

\Symfony\Component\Routing\Route $route: The route to consider attaching to.

Return value

bool TRUE if this access checker applies to this route.

Overrides AccessCheckInterface::applies

File

core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php, line 50

Class

CsrfRequestHeaderAccessCheck

Access protection against CSRF attacks.

Namespace

Drupal\Core\Access

Code

public function applies(Route $route) {
  $requirements = $route
    ->getRequirements();
  if (array_key_exists('_csrf_request_header_token', $requirements)) {
    if (isset($requirements['_method'])) {

      // There could be more than one method requirement separated with '|'.
      $methods = explode('|', $requirements['_method']);

      // CSRF protection only applies to write operations, so we can filter
      // out any routes that require reading methods only.
      $write_methods = array_diff($methods, [
        'GET',
        'HEAD',
        'OPTIONS',
        'TRACE',
      ]);
      if (empty($write_methods)) {
        return FALSE;
      }
    }

    // No method requirement given, so we run this access check to be on the
    // safe side.
    return TRUE;
  }
}