fantoine / csrf-route-bundle
Symfony2 bundle which provides a simple way to add CSRF tokens to routes
Installs: 5 203
Dependents: 0
Suggesters: 0
Security: 0
Stars: 2
Watchers: 3
Forks: 3
Open Issues: 0
Type:symfony-bundle
Requires
- php: >=5.4.0
- symfony/framework-bundle: ~2.1,<3.0
This package is not auto-updated.
Last update: 2024-08-28 14:32:40 UTC
README
*/!\ This bundle is no more supported and has moved to Genedys/csrf-route-bundle /!*
FantoineCsrfRouteBundle
This Symfony2 bundle provides route annotation and options to secure routes against CSRF attacks and without using forms.
Installation
Use Composer to install the bundle:
composer require fantoine/csrf-route-bundle '~1.0@dev'
or add the following line in your composer.json
file:
"require": { ... "fantoine/csrf-route-bundle": "~1.0@dev", ... }
Then, register the bundle in your application's kernel class:
// app/AppKernel.php public function registerBundles() { $bundles = array( // ... new Fantoine\CsrfRouteBundle\FantoineCsrfRouteBundle(), // ... ); }
Configuration
Configuration reference :
fantoine_csrf_route: enabled: true field_name: _token
- enabled : Enable or disable the token verification (default:
true
); - field_name : The name of the field appended to route URLs (default:
_token
).
Usage
The only thing to do to use this package is to add some configurations to the routes you want to protect.
The bundle adds a router which can append a token query parameter on route generation and a controller listener validate which validates token on called routes.
Options configuration
The bundle checks controller calls and search for a csrf_token
option. The available parameters for this options are:
token
: The token parameter name (by default_token
)intention
: The token intention. Different intentions generate different tokens (by defaultnull
which results to the route name).methods
: The HTTP method(s) when the CSRF token is validated (by defaultGET
).
# app/config/routing.yml homepage: ... options: - csrf_token: - token: '_token' - intention: null - methods: [GET]
You can also only specify the csrf_token
option to true
to use default parameters.
# app/config/routing.yml homepage: ... options: { csrf_token: true }
Annotation configuration
If you use annotations to configurate your routes, then the easiest way it to add an additionnal annotation to the sensible actions:
<?php // src Acme\DemoBundle\Controller\DefaultController.php // ... use Fantoine\CsrfRouteBundle\Annotation\CsrfToken; // ... class DefaultController { // ... /** * ... * @CsrfToken */ public function sensibleAction() { //... } // ... }
Twig integration
As the bundle provides a custom router, CSRF tokens are automatically appended to url generated with path(...)
and url(...)
on Twig templates.
Routers compatibility
This bundle overrides the default Symfony router. In case you use other bundles which does the same thing (for instance JMSI18nRoutingBundle), the router integrated on this bundle works automatically as an adapter on previously configurated router. The only thing to take care is to register the FantoineCsrfRouterBundle after the bundle which overrides the router.
Credits
Created by Fabien Antoine.
License
This bundle is under the MIT license.