diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
forked from https://github.com/symfony/symfony
This repository has been archived on 2023-08-20. You can view files and clone it, but cannot push or open issues or pull requests.
15,420 Commits 24 Branches 563 Tags 228 MiB
PHP 98.7%
Twig 1.1%
CSS 0.1%
0f80916313
Go to file
Fabien Potencier 0f80916313 feature#6554 [Security] Added Security\Csrf sub-component with better token generation (bschussek) 
This PR was merged into the master branch.

Discussion
----------

[Security] Added Security\Csrf sub-component with better token generation

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | TODO

**Update September 27, 2013**

This PR simplifies the CSRF mechanism to generate completely random tokens. A random token is generated once per ~~intention~~ token ID and then stored in the session. Tokens are valid until the session expires.

Since the CSRF token generator depends on `StringUtils` and `SecureRandom` from Security\Core, and since Security\Http currently depends on the Form component for token generation, I decided to add a new Security\Csrf sub-component that contains the improved CSRF token generator. Consequences:

* Security\Http now depends on Security\Csrf instead of Form
* Form now optionally depends on Security\Csrf
* The configuration for the "security.secure_random" service and the "security.csrf.*" services was moved to FrameworkBundle to guarantee BC

In the new Security\Csrf sub-component, I tried to improve the naming where I could do so without breaking BC:

* CSRF "providers" are now called "token generators"
* CSRF "intentions" are now called "token IDs", because that's really what they are

##### TODO

- [ ] The documentation needs to be checked for references to the configuration of the application secret. Remarks that the secret is used for CSRF protection need to be removed.
- [ ] Add aliases "csrf_token_generator" and "csrf_token_id" for "csrf_provider" and "intention" in the SecurityBundle configuration
- [x] Make sure `SecureRandom` never blocks for `CsrfTokenGenerator`

Commits
-------

7f02304 [Security] Added missing PHPDoc tag
2e04e32 Updated Composer dependencies to require the Security\Csrf component where necessary
bf85e83 [FrameworkBundle][SecurityBundle] Added service configuration for the new Security CSRF sub-component
2048cf6 [Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead
85d4959 [Security] Changed Security HTTP sub-component to depend on CSRF sub-component instead of Form
1bf1640 [Security] Added CSRF sub-component
2013-09-30 17:35:08 +02:00
src/Symfony feature#6554 [Security] Added Security\Csrf sub-component with better token generation (bschussek) 2013-09-30 17:35:08 +02:00
.editorconfig Add EditorConfig File 2012-06-16 14:08:15 +02:00
.gitignore ignore composer.phar 2012-04-20 14:10:06 +01:00
.travis.yml Removed old way of building icu data. 2013-09-25 09:44:05 +01:00
autoload.php.dist made the dist autoloader to return the autoloder 2013-05-09 09:12:11 +02:00
CHANGELOG-2.2.md Merge branch '2.2' into 2.3 2013-09-26 14:37:59 +02:00
CHANGELOG-2.3.md updated CHANGELOG for 2.3.5 2013-09-27 09:31:22 +02:00
composer.json [Security] Added CSRF sub-component 2013-09-27 10:08:54 +02:00
CONTRIBUTING.md Making it easier to grab the PR template. 2012-12-15 21:57:27 +00:00
CONTRIBUTORS.md update CONTRIBUTORS for 2.2.7 2013-09-25 21:13:45 +02:00
LICENSE updated license year 2013-01-04 17:58:00 +01:00
phpunit.xml.dist [Security] Split the component into 3 sub-components Core, ACL, HTTP 2013-09-18 09:16:41 +02:00
README.md Fix typos in README 2013-01-19 11:32:41 +01:00
UPGRADE-2.1.md [CS Fix] Consistent coding-style of concatenation operator usage 2013-04-02 10:39:57 +01:00
UPGRADE-2.2.md Merge branch '2.2' into 2.3 2013-09-18 09:03:56 +02:00
UPGRADE-2.3.md [BrowserKit] should not follow redirects if status code is not 30x 2013-05-15 17:16:46 +02:00
UPGRADE-2.4.md [Form] Changed (Number|Integer)ToLocalizedStringTransformer::reverseTransform() to do rounding 2013-08-01 17:19:11 +02:00
UPGRADE-3.0.md [Form] Deprecated the CSRF implementation and added an optional dependency to the Security CSRF sub-component instead 2013-09-27 10:12:40 +02:00

README.md

README

What is Symfony2?

Symfony2 is a PHP 5.3 full-stack web framework. It is written with speed and flexibility in mind. It allows developers to build better and easy to maintain websites with PHP.

Symfony can be used to develop all kind of websites, from your personal blog to high traffic ones like Dailymotion or Yahoo! Answers.

Requirements

Symfony2 is only supported on PHP 5.3.3 and up.

Be warned that PHP versions before 5.3.8 are known to be buggy and might not work for you:

Installation

The best way to install Symfony2 is to download the Symfony Standard Edition available at http://symfony.com/download.

Documentation

The "Quick Tour" tutorial gives you a first feeling of the framework. If, like us, you think that Symfony2 can help speed up your development and take the quality of your work to the next level, read the official Symfony2 documentation.

Contributing

Symfony2 is an open source, community-driven project. If you'd like to contribute, please read the Contributing Code part of the documentation. If you're submitting a pull request, please follow the guidelines in the Submitting a Patch section and use Pull Request Template.

Running Symfony2 Tests

Information on how to run the Symfony2 test suite can be found in the Running Symfony2 Tests section.