[Security] Add support for dynamic CSRF id with Expression in #[IsCsrfTokenValid]

[yguedidi]

Q	A
Branch?	7.1
Bug fix?	no
New feature?	yes
Deprecations?	no
Issues	continuation of #52961 from Hackday
License	MIT

Use case is for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following:

{# in a loop over multiple posts #}
<form action="{{ path('post_delete', {post: post.id}) }}" method="POST">
    <input type="hidden" name="_token" value="{{ csrf_token('delete-post-' ~ post.id) }}">
    ...
</form>

The new feature will allow:

#[IsCsrfTokenValid(new Expression('"delete-post-" ~ args["post"].id'))]
public function delete(Request $request, Post $post): Response
{
    // ... delete the post
}

Maybe this need more tests but need help identify which test cases are useful.
Hope this can pass before the feature freeze

[94noni]

will this works with for example an object in the controller action ?

Expression (delete item « post.slug »)
__invoke(Post $post)

[yguedidi]

will this works with for example an object in the controller action ?

@94noni yes it should as it used the ExpressionLanguage component, like in IsGranted you can set subject="post.author"

[smnandre]

I'm curious what is the problem this scenario help to solve ? You still have to write manually this id on the template right ?

[yguedidi]

I'm curious what is the problem this scenario help to solve ? You still have to write manually this id on the template right ?

@smnandre it's for example on a list page with delete action per item, and you want a CSRF token per item, so in the template you have something like the following:

{# in a loop over multiple posts #}
<form action="{{ path('post_delete', {post: post.id}) }}" method="POST">
    <input type="hidden" name="_token" value="{{ csrf_token('delete-post-' ~ post.id) }}">
    ...
</form>

[stof]

The code snippet in the description is also wrong. Accessing a key in an array will be args["post"], not args.post. In ExpressionLanguage, the . operator is a strict equivalent of the -> operator in PHP. It does not have the Twig magic.

[yguedidi]

The code snippet in the description is also wrong. Accessing a key in an array will be args["post"], not args.post. In ExpressionLanguage, the . operator is a strict equivalent of the -> operator in PHP. It does not have the Twig magic.

good catch! was written from memory without checking, thank you, description updated

[nicolas-grekas]

Thank you @yguedidi.