public function matchRequest(RequestInterface $request)
    {
        if (!$request instanceof ActionRequest || SecurityHelper::hasSafeMethod($request->getHttpRequest())) {
            $this->logger->debug('CSRF: No token required, safe request');
            return false;
        }
        if ($this->authenticationManager->isAuthenticated() === false) {
            $this->logger->debug('CSRF: No token required, not authenticated');
            return false;
        }
        if ($this->securityContext->areAuthorizationChecksDisabled() === true) {
            $this->logger->debug('CSRF: No token required, authorization checks are disabled');
            return false;
        }

        $controllerClassName = $this->objectManager->getClassNameByObjectName($request->getControllerObjectName());
        $actionMethodName = $request->getControllerActionName() . 'Action';

        if (!$this->hasPolicyEntryForMethod($controllerClassName, $actionMethodName)) {
            $this->logger->debug(sprintf('CSRF: No token required, method %s::%s() is not restricted by a policy.', $controllerClassName, $actionMethodName));
            return false;
        }
        if ($this->reflectionService->isMethodTaggedWith($controllerClassName, $actionMethodName, 'skipcsrfprotection')) {
            $this->logger->debug(sprintf('CSRF: No token required, method %s::%s() is tagged with a "skipcsrfprotection" annotation', $controllerClassName, $actionMethodName));
            return false;
        }

        $httpRequest = $request->getHttpRequest();
        if ($httpRequest->hasHeader('X-Flow-Csrftoken')) {
            $csrfToken = $httpRequest->getHeader('X-Flow-Csrftoken');
        } else {
            $internalArguments = $request->getMainRequest()->getInternalArguments();
            $csrfToken = isset($internalArguments['__csrfToken']) ? $internalArguments['__csrfToken'] : null;
        }

        if (empty($csrfToken)) {
            $this->logger->debug(sprintf('CSRF: token was empty but a valid token is required for %s::%s()', $controllerClassName, $actionMethodName));
            return true;
        }

        if (!$this->securityContext->hasCsrfProtectionTokens()) {
            throw new AuthenticationRequiredException(sprintf('CSRF: No CSRF tokens in security context, possible session timeout. A valid token is required for %s::%s()', $controllerClassName, $actionMethodName), 1317309673);
        }

        if ($this->securityContext->isCsrfProtectionTokenValid($csrfToken) === false) {
            $this->logger->debug(sprintf('CSRF: token was invalid but a valid token is required for %s::%s()', $controllerClassName, $actionMethodName));
            return true;
        }

        $this->logger->debug(sprintf('CSRF: Successfully verified token for %s::%s()', $controllerClassName, $actionMethodName));
        return false;
    }
public function matchRequest(RequestInterface $request)
    {
        if (!$request instanceof ActionRequest || SecurityHelper::hasSafeMethod($request->getHttpRequest())) {
            $this->logger->debug('CSRF: No token required, safe request');
            return false;
        }
        if ($this->authenticationManager->isAuthenticated() === false) {
            $this->logger->debug('CSRF: No token required, not authenticated');
            return false;
        }
        if ($this->securityContext->areAuthorizationChecksDisabled() === true) {
            $this->logger->debug('CSRF: No token required, authorization checks are disabled');
            return false;
        }

        $controllerClassName = $this->objectManager->getClassNameByObjectName($request->getControllerObjectName());
        $actionMethodName = $request->getControllerActionName() . 'Action';

        if (!$this->hasPolicyEntryForMethod($controllerClassName, $actionMethodName)) {
            $this->logger->debug(sprintf('CSRF: No token required, method %s::%s() is not restricted by a policy.', $controllerClassName, $actionMethodName));
            return false;
        }
        if ($this->reflectionService->isMethodTaggedWith($controllerClassName, $actionMethodName, 'skipcsrfprotection')) {
            $this->logger->debug(sprintf('CSRF: No token required, method %s::%s() is tagged with a "skipcsrfprotection" annotation', $controllerClassName, $actionMethodName));
            return false;
        }

        $httpRequest = $request->getHttpRequest();
        if ($httpRequest->hasHeader('X-Flow-Csrftoken')) {
            $csrfToken = $httpRequest->getHeader('X-Flow-Csrftoken');
        } else {
            $internalArguments = $request->getMainRequest()->getInternalArguments();
            $csrfToken = isset($internalArguments['__csrfToken']) ? $internalArguments['__csrfToken'] : null;
        }

        if (empty($csrfToken)) {
            $this->logger->debug(sprintf('CSRF: token was empty but a valid token is required for %s::%s()', $controllerClassName, $actionMethodName));
            return true;
        }

        if (!$this->securityContext->hasCsrfProtectionTokens()) {
            throw new AuthenticationRequiredException(sprintf('CSRF: No CSRF tokens in security context, possible session timeout. A valid token is required for %s::%s()', $controllerClassName, $actionMethodName), 1317309673);
        }

        if ($this->securityContext->isCsrfProtectionTokenValid($csrfToken) === false) {
            $this->logger->debug(sprintf('CSRF: token was invalid but a valid token is required for %s::%s()', $controllerClassName, $actionMethodName));
            return true;
        }

        $this->logger->debug(sprintf('CSRF: Successfully verified token for %s::%s()', $controllerClassName, $actionMethodName));
        return false;
    }
public function matchRequest ( RequestInterface $ request ) { if ( ! $ request instanceof ActionRequest || SecurityHelper :: hasSafeMethod ( $ request -> getHttpRequest ( ) ) ) { $ this -> logger -> debug ( 'CSRF: No token required, safe request' ) ; return false ; } if ( $ this -> authenticationManager -> isAuthenticated ( ) === false ) { $ this -> logger -> debug ( 'CSRF: No token required, not authenticated' ) ; return false ; } if ( $ this -> securityContext -> areAuthorizationChecksDisabled ( ) === true ) { $ this -> logger -> debug ( 'CSRF: No token required, authorization checks are disabled' ) ; return false ; } $ controllerClassName = $ this -> objectManager -> getClassNameByObjectName ( $ request -> getControllerObjectName ( ) ) ; $ actionMethodName = $ request -> getControllerActionName ( ) . 'Action' ; if ( ! $ this -> hasPolicyEntryForMethod ( $ controllerClassName , $ actionMethodName ) ) { $ this -> logger -> debug ( sprintf ( 'CSRF: No token required, method %s::%s() is not restricted by a policy.' , $ controllerClassName , $ actionMethodName ) ) ; return false ; } if ( $ this -> reflectionService -> isMethodTaggedWith ( $ controllerClassName , $ actionMethodName , 'skipcsrfprotection' ) ) { $ this -> logger -> debug ( sprintf ( 'CSRF: No token required, method %s::%s() is tagged with a "skipcsrfprotection" annotation' , $ controllerClassName , $ actionMethodName ) ) ; return false ; } $ httpRequest = $ request -> getHttpRequest ( ) ; if ( $ httpRequest -> hasHeader ( 'X-Flow-Csrftoken' ) ) { $ csrfToken = $ httpRequest -> getHeader ( 'X-Flow-Csrftoken' ) ; } else { $ internalArguments = $ request -> getMainRequest ( ) -> getInternalArguments ( ) ; $ csrfToken = isset ( $ internalArguments [ '__csrfToken' ] ) ? $ internalArguments [ '__csrfToken' ] : null ; } if ( empty ( $ csrfToken ) ) { $ this -> logger -> debug ( sprintf ( 'CSRF: token was empty but a valid token is required for %s::%s()' , $ controllerClassName , $ actionMethodName ) ) ; return true ; } if ( ! $ this -> securityContext -> hasCsrfProtectionTokens ( ) ) { throw new AuthenticationRequiredException ( sprintf ( 'CSRF: No CSRF tokens in security context, possible session timeout. A valid token is required for %s::%s()' , $ controllerClassName , $ actionMethodName ) , 1317309673 ) ; } if ( $ this -> securityContext -> isCsrfProtectionTokenValid ( $ csrfToken ) === false ) { $ this -> logger -> debug ( sprintf ( 'CSRF: token was invalid but a valid token is required for %s::%s()' , $ controllerClassName , $ actionMethodName ) ) ; return true ; } $ this -> logger -> debug ( sprintf ( 'CSRF: Successfully verified token for %s::%s()' , $ controllerClassName , $ actionMethodName ) ) ; return false ; }
Matches a \Neos\Flow\Mvc\RequestInterface against the configured CSRF pattern rules and
searches for invalid csrf tokens. If this returns true, the request is invalid!

@param RequestInterface $request The request that should be matched
@return boolean true if the pattern matched, false otherwise
@throws AuthenticationRequiredException
Matches a \ Neos \ Flow \ Mvc \ RequestInterface against the configured CSRF pattern rules and searches for invalid csrf tokens . If this returns true the request is invalid!