dispense AntiForgery from HttpContext

Author: Machometec

lib/Endpoint/Filters/ValidateAntiForgery.php

@@ -26,9 +26,17 @@ public function __invoke(ActionContext $context, ActionDelegate $next): Task
             throw new AntiForgeryException("Unable to get IAntiForgery service, make sure to register it as a service!");
         }
 
-        $result = $antiForgery->validateToken($context->HttpContext);
+        $method = $context->HttpContext->Request->Method;
+        if ($method == 'GET') {
+            return next($context);
+        }
+
+        $formToken = $context->HttpContext->Request->Form->getValue($antiForgery->options->FieldName);
+        $headerToken = $context->HttpContext->Request->Headers->getValues($antiForgery->options->FieldName)[0] ?? null;
+        $formResult = $antiForgery->validateToken($formToken);
+        $headerResult = $antiForgery->validateToken($headerToken);
 
-        if (!$result) {
+        if (!$formResult && !$headerResult) {
             throw new AntiForgeryException("Invalid AntiForgery Token!", 403);
         }
 

lib/Security/Session.php

@@ -14,17 +14,17 @@ class Session
     private string $name;
     private array $options = [];
 
-    public function __construct(string $name, ?int $lifetime = null, ?string $path = null)
+    public function __construct(string $name, string $path = '/', ?int $lifetime = null)
     {
         $this->name = $name;
         $this->options['name'] = $name;
 
-        if (isset($lifetime)) {
-            $this->options['cookie_lifetime'] = $lifetime;
+        if (!empty($path)) {
+            $this->options['cookie_path'] = $path;
         }
 
-        if (isset($path)) {
-            $this->options['cookie_path'] = $path;
+        if (isset($lifetime)) {
+            $this->options['cookie_lifetime'] = $lifetime;
         }
 
         if (isset($_COOKIE[$name])) {

lib/Security/Tokens/Csrf/Antiforgery.php

@@ -9,7 +9,6 @@
 namespace DevNet\Web\Security\Tokens\Csrf;
 
 use DevNet\System\PropertyTrait;
-use DevNet\Web\Http\Message\HttpContext;
 
 class AntiForgery implements IAntiForgery
 {
@@ -21,10 +20,6 @@ class AntiForgery implements IAntiForgery
 
     public function __construct(AntiForgeryOptions $options)
     {
-        if ($options->Cookie->HttpOnly === null) {
-            $options->Cookie->HttpOnly = true;
-        }
-
         $this->options   = $options;
         $this->generator = new AntiForgeryTokenGenerator();
         $this->store     = new AntiForgeryTokenStore($options);
@@ -47,22 +42,9 @@ public function getToken(): AntiForgeryToken
         return $token;
     }
 
-    public function validateToken(HttpContext $httpContext): bool
+    public function validateToken(string $token): bool
     {
-        $method = $httpContext->Request->Method;
-        if ($method == "GET") {
-            return true;
-        }
-
-        $token = $this->getToken();
-
-        $formToken = $httpContext->Request->Form->getValue($this->options->FieldName);
-        if ($formToken == $token) {
-            return true;
-        }
-
-        $headerToken = $httpContext->Request->Headers->getValues($this->options->FieldName)[0] ?? null;
-        if ($headerToken == $token) {
+        if ($this->getToken() == $token) {
             return true;
         }
 

lib/Security/Tokens/Csrf/AntiforgeryOptions.php

@@ -8,19 +8,15 @@
 
 namespace DevNet\Web\Security\Tokens\Csrf;
 
-use DevNet\System\Runtime\LauncherProperties;
-use DevNet\Web\Http\Message\CookieOptions;
-
 class AntiForgeryOptions
 {
-    public CookieOptions $Cookie;
     public string $CookieName = "AntiForgery";
+    public string $CookiePath = "/";
     public string $FieldName  = "X-CSRF-TOKEN";
     public string $HeaderName = "X-XSRF-TOKEN";
 
     public function __construct()
     {
-        $this->Cookie     = new CookieOptions();
-        $this->CookieName = $this->CookieName . "-" . md5($this->CookieName . LauncherProperties::getRootDirectory());;
+        $this->CookieName = $this->CookieName . "-" . md5($this->CookieName . $_SERVER['DOCUMENT_ROOT']);;
     }
 }

lib/Security/Tokens/Csrf/AntiforgeryTokenGenerator.php

@@ -8,8 +8,6 @@
 
 namespace DevNet\Web\Security\Tokens\Csrf;
 
-use DevNet\Web\Http\Message\HttpContext;
-
 class AntiForgeryTokenGenerator
 {
     public function generateCookieToken(): AntiForgeryToken
@@ -21,15 +19,4 @@ public function generateRequestToken(string $cookieToken): AntiForgeryToken
     {
         return new AntiForgeryToken($cookieToken);
     }
-
-    public function matchTokens(HttpContext $httpContext, $tokens): bool
-    {
-        $formToken = $httpContext->Request->Form->getValue($tokens->FormFieldName);
-
-        if ($tokens->RequestToken == $formToken) {
-            return true;
-        }
-
-        return false;
-    }
 }

lib/Security/Tokens/Csrf/AntiforgeryTokenSet.php

@@ -16,7 +16,7 @@ class AntiForgeryTokenStore
 
     public function __construct(AntiForgeryOptions $options)
     {
-        $this->session = new Session($options->CookieName);
+        $this->session = new Session($options->CookieName, $options->CookieName);
     }
 
     public function saveCookieToken(AntiForgeryToken $token): void

lib/Security/Tokens/Csrf/AntiforgeryTokenStore.php

@@ -8,11 +8,9 @@
 
 namespace DevNet\Web\Security\Tokens\Csrf;
 
-use DevNet\Web\Http\Message\HttpContext;
-
 interface IAntiForgery
 {
     public function getToken(): AntiForgeryToken;
 
-    public function validateToken(HttpContext $httpContext): bool;
+    public function validateToken(string $token): bool;
 }