function CsrfAccessCheck::access

Checks access based on a CSRF token for the request.

Parameters

\Symfony\Component\Routing\Route $route: The route to check against.

\Symfony\Component\HttpFoundation\Request $request: The request object.

\Drupal\Core\Routing\RouteMatchInterface $route_match: The route match object.

Return value

\Drupal\Core\Access\AccessResultInterface The access result.

File

core/lib/Drupal/Core/Access/CsrfAccessCheck.php, line 57

Class

CsrfAccessCheck

Access protection against CSRF attacks.

Namespace

Drupal\Core\Access

Code

public function access(Route $route, Request $request, RouteMatchInterface $route_match) {
    $parameters = $route_match->getRawParameters();
    $path = ltrim($route->getPath(), '/');
    // Replace the path parameters with values from the parameters array.
    foreach ($parameters as $param => $value) {
        $path = str_replace("{{$param}}", $value, $path);
    }
    if ($this->csrfToken
        ->validate($request->query
        ->get('token', ''), $path)) {
        $result = AccessResult::allowed();
    }
    else {
        $result = AccessResult::forbidden($request->query
            ->has('token') ? "'csrf_token' URL query argument is invalid." : "'csrf_token' URL query argument is missing.");
    }
    // Not cacheable because the CSRF token is highly dynamic.
    return $result->setCacheMaxAge(0);
}