Checks access based on a CSRF token for the request.

Parameters

\Symfony\Component\Routing\Route $route: The route to check against.

\Symfony\Component\HttpFoundation\Request $request: The request object.

\Drupal\Core\Routing\RouteMatchInterface $route_match: The route match object.

Return value

\Drupal\Core\Access\AccessResultInterface The access result.

File

core/lib/Drupal/Core/Access/CsrfAccessCheck.php, line 57

Class

CsrfAccessCheck

Access protection against CSRF attacks.

Namespace

Drupal\Core\Access

Code

public function access(Route $route, Request $request, RouteMatchInterface $route_match) {
  $parameters = $route_match->getRawParameters();
  $path = ltrim($route->getPath(), '/');
  // Replace the path parameters with values from the parameters array.
  foreach ($parameters as $param => $value) {
    $path = str_replace("{{$param}}", $value, $path);
  }
  if ($this->csrfToken
    ->validate($request->query
    ->get('token', ''), $path)) {
    $result = AccessResult::allowed();
  }
  else {
    $result = AccessResult::forbidden($request->query
      ->has('token') ? "'csrf_token' URL query argument is invalid." : "'csrf_token' URL query argument is missing.");
  }
  // Not cacheable because the CSRF token is highly dynamic.
  return $result->setCacheMaxAge(0);
}

---