public function CsrfRequestHeaderAccessCheck::applies in Drupal 10
Same name and namespace in other branches
- 8 core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::applies()
- 9 core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::applies()
Declares whether the access check applies to a specific route or not.
Parameters
\Symfony\Component\Routing\Route $route: The route to consider attaching to.
Return value
bool TRUE if this access checker applies to this route.
Overrides AccessCheckInterface::applies
File
- core/
lib/ Drupal/ Core/ Access/ CsrfRequestHeaderAccessCheck.php, line 50
Class
- CsrfRequestHeaderAccessCheck
- Access protection against CSRF attacks.
Namespace
Drupal\Core\AccessCode
public function applies(Route $route) {
$requirements = $route
->getRequirements();
if (array_key_exists('_csrf_request_header_token', $requirements)) {
if (isset($requirements['_method'])) {
// There could be more than one method requirement separated with '|'.
$methods = explode('|', $requirements['_method']);
// CSRF protection only applies to write operations, so we can filter
// out any routes that require reading methods only.
$write_methods = array_diff($methods, [
'GET',
'HEAD',
'OPTIONS',
'TRACE',
]);
if (empty($write_methods)) {
return FALSE;
}
}
// No method requirement given, so we run this access check to be on the
// safe side.
return TRUE;
}
}