class CsrfTokenGenerator in Zircon Profile 8
Same name and namespace in other branches
- 8.0 core/lib/Drupal/Core/Access/CsrfTokenGenerator.php \Drupal\Core\Access\CsrfTokenGenerator
Generates and validates CSRF tokens.
Hierarchy
- class \Drupal\Core\Access\CsrfTokenGenerator
Expanded class hierarchy of CsrfTokenGenerator
See also
\Drupal\Tests\Core\Access\CsrfTokenGeneratorTest
6 files declare their use of CsrfTokenGenerator
- AjaxBasePageNegotiator.php in core/
lib/ Drupal/ Core/ Theme/ AjaxBasePageNegotiator.php - Contains \Drupal\Core\Theme\AjaxBasePageNegotiator.
- BatchStorage.php in core/
lib/ Drupal/ Core/ Batch/ BatchStorage.php - Contains \Drupal\Core\Batch\BatchStorage.
- CsrfTokenGeneratorTest.php in core/
tests/ Drupal/ Tests/ Core/ Access/ CsrfTokenGeneratorTest.php - Contains \Drupal\Tests\Core\Access\CsrfTokenGeneratorTest.
- FormBuilder.php in core/
lib/ Drupal/ Core/ Form/ FormBuilder.php - Contains \Drupal\Core\Form\FormBuilder.
- FormCache.php in core/
lib/ Drupal/ Core/ Form/ FormCache.php - Contains \Drupal\Core\Form\FormCache.
1 string reference to 'CsrfTokenGenerator'
- core.services.yml in core/
core.services.yml - core/core.services.yml
1 service uses CsrfTokenGenerator
File
- core/
lib/ Drupal/ Core/ Access/ CsrfTokenGenerator.php, line 20 - Contains \Drupal\Core\Access\CsrfTokenGenerator.
Namespace
Drupal\Core\AccessView source
class CsrfTokenGenerator {
/**
* The private key service.
*
* @var \Drupal\Core\PrivateKey
*/
protected $privateKey;
/**
* The session metadata bag.
*
* @var \Drupal\Core\Session\MetadataBag
*/
protected $sessionMetadata;
/**
* Constructs the token generator.
*
* @param \Drupal\Core\PrivateKey $private_key
* The private key service.
* @param \Drupal\Core\Session\MetadataBag $session_metadata
* The session metadata bag.
*/
public function __construct(PrivateKey $private_key, MetadataBag $session_metadata) {
$this->privateKey = $private_key;
$this->sessionMetadata = $session_metadata;
}
/**
* Generates a token based on $value, the user session, and the private key.
*
* The generated token is based on the session of the current user. Normally,
* anonymous users do not have a session, so the generated token will be
* different on every page request. To generate a token for users without a
* session, manually start a session prior to calling this function.
*
* @param string $value
* (optional) An additional value to base the token on.
*
* @return string
* A 43-character URL-safe token for validation, based on the token seed,
* the hash salt provided by Settings::getHashSalt(), and the
* 'drupal_private_key' configuration variable.
*
* @see \Drupal\Core\Site\Settings::getHashSalt()
* @see \Symfony\Component\HttpFoundation\Session\SessionInterface::start()
*/
public function get($value = '') {
$seed = $this->sessionMetadata
->getCsrfTokenSeed();
if (empty($seed)) {
$seed = Crypt::randomBytesBase64();
$this->sessionMetadata
->setCsrfTokenSeed($seed);
}
return $this
->computeToken($seed, $value);
}
/**
* Validates a token based on $value, the user session, and the private key.
*
* @param string $token
* The token to be validated.
* @param string $value
* (optional) An additional value to base the token on.
*
* @return bool
* TRUE for a valid token, FALSE for an invalid token.
*/
public function validate($token, $value = '') {
$seed = $this->sessionMetadata
->getCsrfTokenSeed();
if (empty($seed)) {
return FALSE;
}
return $token === $this
->computeToken($seed, $value);
}
/**
* Generates a token based on $value, the token seed, and the private key.
*
* @param string $seed
* The per-session token seed.
* @param string $value
* (optional) An additional value to base the token on.
*
* @return string
* A 43-character URL-safe token for validation, based on the token seed,
* the hash salt provided by Settings::getHashSalt(), and the
* 'drupal_private_key' configuration variable.
*
* @see \Drupal\Core\Site\Settings::getHashSalt()
*/
protected function computeToken($seed, $value = '') {
return Crypt::hmacBase64($value, $seed . $this->privateKey
->get() . Settings::getHashSalt());
}
}
Members
Name | Modifiers | Type | Description | Overrides |
---|---|---|---|---|
CsrfTokenGenerator:: |
protected | property | The private key service. | |
CsrfTokenGenerator:: |
protected | property | The session metadata bag. | |
CsrfTokenGenerator:: |
protected | function | Generates a token based on $value, the token seed, and the private key. | |
CsrfTokenGenerator:: |
public | function | Generates a token based on $value, the user session, and the private key. | |
CsrfTokenGenerator:: |
public | function | Validates a token based on $value, the user session, and the private key. | |
CsrfTokenGenerator:: |
public | function | Constructs the token generator. |