doufang7385 2015-11-19 11:13
浏览 63

如何在Symfony2中实现CSRF验证

I'm developing my own authentication function, but I'm not using the CSRF verification part, and I would do it (FOSUserBundle is installed and configured).

Here is my PHP controller :

public function checkLoginAjaxAction() {
    $request = $this->get('request');

    $success = false;
    $responseCode = 300;
    if ($request->isMethod('POST') && $request->isXmlHttpRequest()) {
        $user = $this->get('fos_user.user_manager')->findUserBy(array('username' => $request->request->get('_username')));

        if ($user) {
            $encoderManager = $this->get('security.encoder_factory');
            $encoder = $encoderManager->getEncoder($user);
            $encodedPass = $encoder->encodePassword($request->request->get('_password'), $user->getSalt());

            $token = $request->request->get('_csrf_token');
            $res = $this->get('security.csrf.token_manager')->isTokenValid(new CsrfToken('calendar-connection-form', $token));
            dump($res); // always return false...

            if ($user->getPassword() === $encodedPass /* && $res*/) { // but $res is false everytime
                $responseCode = 200;
                $success = true;
            } else {
                $responseCode = 400;
            }
        }

    }
    $return = json_encode(array('responseCode' => $responseCode, 'success' => $success));
    return new Response($return, 200, array('Content-Type'=>'application/json'));
}

In my twig :

<input type="hidden" name="_csrf_token" value="{{ csrf_token('calendar-connection-form') }}" />

So, how can I implement the CSRF token in my authentication ?

By the way, if you see some improvement, tell me (I didn't do the connection part, just the verification, for the moment).

Thanks

  • 写回答

0条回答 默认 最新

    报告相同问题?

    悬赏问题

    • ¥15 这个主板怎么能扩出一两个sata口
    • ¥15 不是,这到底错哪儿了😭
    • ¥15 2020长安杯与连接网探
    • ¥15 关于#matlab#的问题:在模糊控制器中选出线路信息,在simulink中根据线路信息生成速度时间目标曲线(初速度为20m/s,15秒后减为0的速度时间图像)我想问线路信息是什么
    • ¥15 banner广告展示设置多少时间不怎么会消耗用户价值
    • ¥16 mybatis的代理对象无法通过@Autowired装填
    • ¥15 可见光定位matlab仿真
    • ¥15 arduino 四自由度机械臂
    • ¥15 wordpress 产品图片 GIF 没法显示
    • ¥15 求三国群英传pl国战时间的修改方法