CsrfProviderInterface.php 1.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\Form\Extension\Csrf\CsrfProvider;
  11. /**
  12. * Marks classes able to provide CSRF protection.
  13. *
  14. * You can generate a CSRF token by using the method generateCsrfToken(). To
  15. * this method you should pass a value that is unique to the page that should
  16. * be secured against CSRF attacks. This value doesn't necessarily have to be
  17. * secret. Implementations of this interface are responsible for adding more
  18. * secret information.
  19. *
  20. * If you want to secure a form submission against CSRF attacks, you could
  21. * supply an "intention" string. This way you make sure that the form can only
  22. * be submitted to pages that are designed to handle the form, that is, that use
  23. * the same intention string to validate the CSRF token with isCsrfTokenValid().
  24. *
  25. * @author Bernhard Schussek <bschussek@gmail.com>
  26. *
  27. * @deprecated since version 2.4, to be removed in 3.0.
  28. * Use {@link \Symfony\Component\Security\Csrf\CsrfTokenManagerInterface} instead.
  29. */
  30. interface CsrfProviderInterface
  31. {
  32. /**
  33. * Generates a CSRF token for a page of your application.
  34. *
  35. * @param string $intention Some value that identifies the action intention
  36. * (i.e. "authenticate"). Doesn't have to be a secret value.
  37. *
  38. * @return string The generated token
  39. */
  40. public function generateCsrfToken($intention);
  41. /**
  42. * Validates a CSRF token.
  43. *
  44. * @param string $intention The intention used when generating the CSRF token
  45. * @param string $token The token supplied by the browser
  46. *
  47. * @return bool Whether the token supplied by the browser is correct
  48. */
  49. public function isCsrfTokenValid($intention, $token);
  50. }