IBX-833: As a Developer I want to configure CSRF validation in REST endpoints (#76)

Author: adamwojs

src/bundle/EventListener/CsrfListener.php

@@ -104,6 +104,10 @@ public function onKernelRequest(RequestEvent $event)
             return;
         }
 
+        if (!$event->getRequest()->attributes->getBoolean('csrf_protection', true)) {
+            return;
+        }
+
         if (!$this->checkCsrfToken($event->getRequest())) {
             throw new UnauthorizedException(
                 'Missing or invalid CSRF token',
@@ -143,6 +147,8 @@ protected function isLoginRequest($route)
      * @param string $route
      *
      * @return bool
+     *
+     * @deprecated since Ibexa DXP 3.3.7. Add csrf_protection: false attribute to route definition instead.
      */
     protected function isSessionRoute($route)
     {

src/bundle/Resources/config/routing.yml

@@ -1118,18 +1118,21 @@ ezpublish_rest_createSession:
     path: /user/sessions
     defaults:
         _controller: ezpublish_rest.controller.session:createSessionAction
+        csrf_protection: false
     methods: [POST]
 
 ezpublish_rest_deleteSession:
     path: /user/sessions/{sessionId}
     defaults:
         _controller: ezpublish_rest.controller.session:deleteSessionAction
+        csrf_protection: false
     methods: [DELETE]
 
 ezpublish_rest_refreshSession:
     path: /user/sessions/{sessionId}/refresh
     defaults:
         _controller: ezpublish_rest.controller.session:refreshSessionAction
+        csrf_protection: false
     methods: [POST]
 
 

tests/bundle/EventListener/CsrfListenerTest.php

@@ -137,6 +137,15 @@ public static function provideSessionRoutes()
         ];
     }
 
+    public function testSkipCsrfProtection(): void
+    {
+        $this->enableCsrfProtection = false;
+        $this->csrfTokenHeaderValue = null;
+
+        $listener = $this->getEventListener();
+        $listener->onKernelRequest($this->getEvent());
+    }
+
     public function testNoHeader()
     {
         $this->expectException(UnauthorizedException::class);

tests/bundle/EventListener/EventListenerTest.php

@@ -34,6 +34,8 @@ abstract class EventListenerTest extends TestCase
 
     protected $requestMethod = false;
 
+    protected $enableCsrfProtection = true;
+
     /**
      * @dataProvider provideExpectedSubscribedEventTypes
      */
@@ -87,6 +89,11 @@ protected function getRequestAttributesMock()
                 ->method('get')
                 ->with('is_rest_request')
                 ->willReturn($this->isRestRequest);
+
+            $this->requestAttributesMock
+                ->method('getBoolean')
+                ->with('csrf_protection', true)
+                ->willReturn($this->enableCsrfProtection);
         }
 
         return $this->requestAttributesMock;