public function onKernelRequest(GetResponseEvent $event)
    {
        if (!$event->getRequest()->attributes->get('is_rest_request')) {
            return;
        }

        if (!$this->csrfEnabled) {
            return;
        }

        // skip CSRF validation if no session is running
        if (!$event->getRequest()->getSession()->isStarted()) {
            return;
        }

        if ($this->isMethodSafe($event->getRequest()->getMethod())) {
            return;
        }

        if ($this->isSessionRoute($event->getRequest()->get('_route'))) {
            return;
        }

        if (!$this->checkCsrfToken($event->getRequest())) {
            throw new UnauthorizedException(
                'Missing or invalid CSRF token',
                $event->getRequest()->getMethod() . ' ' . $event->getRequest()->getPathInfo()
            );
        }

        // Dispatching event so that CSRF token intention can be injected into Legacy Stack
        $this->eventDispatcher->dispatch(RestEvents::REST_CSRF_TOKEN_VALIDATED);
    }
public function onKernelRequest(GetResponseEvent $event)
    {
        if (!$event->getRequest()->attributes->get('is_rest_request')) {
            return;
        }

        if (!$this->csrfEnabled) {
            return;
        }

        // skip CSRF validation if no session is running
        if (!$event->getRequest()->getSession()->isStarted()) {
            return;
        }

        if ($this->isMethodSafe($event->getRequest()->getMethod())) {
            return;
        }

        if ($this->isSessionRoute($event->getRequest()->get('_route'))) {
            return;
        }

        if (!$this->checkCsrfToken($event->getRequest())) {
            throw new UnauthorizedException(
                'Missing or invalid CSRF token',
                $event->getRequest()->getMethod() . ' ' . $event->getRequest()->getPathInfo()
            );
        }

        // Dispatching event so that CSRF token intention can be injected into Legacy Stack
        $this->eventDispatcher->dispatch(RestEvents::REST_CSRF_TOKEN_VALIDATED);
    }
public function onKernelRequest ( GetResponseEvent $ event ) { if ( ! $ event -> getRequest ( ) -> attributes -> get ( 'is_rest_request' ) ) { return ; } if ( ! $ this -> csrfEnabled ) { return ; } // skip CSRF validation if no session is running if ( ! $ event -> getRequest ( ) -> getSession ( ) -> isStarted ( ) ) { return ; } if ( $ this -> isMethodSafe ( $ event -> getRequest ( ) -> getMethod ( ) ) ) { return ; } if ( $ this -> isSessionRoute ( $ event -> getRequest ( ) -> get ( '_route' ) ) ) { return ; } if ( ! $ this -> checkCsrfToken ( $ event -> getRequest ( ) ) ) { throw new UnauthorizedException ( 'Missing or invalid CSRF token' , $ event -> getRequest ( ) -> getMethod ( ) . ' ' . $ event -> getRequest ( ) -> getPathInfo ( ) ) ; } // Dispatching event so that CSRF token intention can be injected into Legacy Stack $ this -> eventDispatcher -> dispatch ( RestEvents :: REST_CSRF_TOKEN_VALIDATED ) ; }
This method validates CSRF token if CSRF protection is enabled.

@param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event

@throws \eZ\Publish\Core\Base\Exceptions\UnauthorizedException
This method validates CSRF token if CSRF protection is enabled .