CsrfMiddleware and CsrfAwareActionInterface

[mj4444ru]

CsrfMiddleware is currently running for all requests. However, this functionality is sometimes not required, or a separate implementation is required for individual endpoints that process external requests as API.

Magento has a CsrfAwareActionInterface endpoint interface. If implemented, the endpoint checks the Csrf itself, otherwise the Csrf is checked by Magento. You need to do something like this.

[samdark]

That's already possible. Middleware could be used in three ways:

1. Via main application stack.
2. Via route group stack.
3. Via individual route stack.

All these are configured at the application level. That's already in docs but will be even more visible after alpha release: https://github.com/yiisoft/docs/blob/master/guide/en/structure/middleware.md

[mj4444ru]

It is clear that it is possible to add it. But I mean that it would be nice to be able to add the CsrfAwareActionInterface interface in the controller and not implement your own CsrfMiddleware. Now we have CsrfMiddleware whose area is very limited, and it is inconvenient to use it for separate routes. In case of difficulties, 99% of people will not write their own CsrfMiddleware, they will simply disable it.

[samdark]

Now we have CsrfMiddleware whose area is very limited

It's not. Exactly the same middleware could be registered for individual route or routes group.

it is inconvenient to use it for separate routes

What is inconvenient in the following?

Group::create('/user', [
  // routes here        
])->addMiddleware(\Yiisoft\Csrf\CsrfMiddleware::class),

[mj4444ru]

What if third-party modules add routes for which Csrf is not needed? Will they have to ask the user to change their global configuration? Remove from the chain above CsrfMiddleware applications? I find it difficult.
I understand that you want to make it as simple as possible, but a step to the left, a step to the right, there are problems. This is not forward-looking.

PS: This is from experience. I had to solve a similar problem the other day in a commercial project.

[samdark]

Alright. CSRF is likely worth to be moved to router level.