Question

从这里Generate new CSRF token without reloading the entire form我了解到有一个方法refreshToken()但是我的代码在下面我使用symfony表单组件的方式和部分，我应该使用该方法修改以强制我的表单生成一个我每次加载脚本时都会使用新的csrf吗？

$csrfStorage = new NativeSessionTokenStorage();
$csrfGenerator = new UriSafeTokenGenerator();
$csrfManager = new CsrfTokenManager($csrfGenerator, $csrfStorage);

$formFactory = Forms::createFormFactoryBuilder()
    ->addExtension(new CsrfExtension($csrfManager))
    ->getFormFactory();


$defaultFormTheme = 'bootstrap_3_layout.html.twig';

$vendorDir = realpath(__DIR__.'/../vendor');
$appVariableReflection = new \ReflectionClass('\Symfony\Bridge\Twig\AppVariable');
$vendorTwigBridgeDir = dirname($appVariableReflection->getFileName());
$viewsDir = realpath('twig');

$twig = new Twig_Environment(new Twig_Loader_Filesystem(array(
    $viewsDir,
    $vendorTwigBridgeDir.'/Resources/views/Form',
)));
$formEngine = new TwigRendererEngine(array($defaultFormTheme), $twig);
$twig->addRuntimeLoader(new \Twig_FactoryRuntimeLoader(array(
    TwigRenderer::class => function () use ($formEngine, $csrfManager) {
        return new TwigRenderer($formEngine, $csrfManager);
    },
)));
$twig->addExtension(new FormExtension());

$translator = new Translator('en');
$twig->addExtension(new TranslationExtension($translator));
$form = $formFactory->createBuilder()
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$request = Request::createFromGlobals();
$form->handleRequest();
if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();
    print_r($data);
}

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));


$csrfManager->refreshToken('form');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', array('task' => 'gggg'),  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'form'))
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));

编辑：现在在答案的帮助下，它总是刷新，但现在的问题是它总是一个无效的形式。我做错了什么？

$csrfManager->refreshToken('my_form_id');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'my_form_id'))

->add('task', TextType::class)
->add('dueDate', DateType::class)
->getForm();
$request = Request::createFromGlobals();

$form->handleRequest();

if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();
    print_r($data);
} else {
    print("invalid");
}

即使预期有效，我该怎么办呢？

EDIT2：

$csrfManager->refreshToken('form');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', array('task' => 'gggg'),  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'form'))
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));


$request = Request::createFromGlobals();

    $session = New Session();
    $session->set($formToken, $csrfManager->getToken($formToken)->getValue());
    $request->setSession($session);
    $form->handleRequest();


if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();

print_r($data);
} else {
print("invalid");
}

Answer 1

$csrfManager->refreshToken('my_form_id');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'my_form_id'))
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

.....

$request = Request::createFromGlobals();
        $formToken = '_csrf/'.$form->getName();
       // $storage = new NativeSessionStorage();
        $session = New Session();
        $session->set($formToken, $csrfManager->getToken($formToken)->getValue());
        $request->setSession($session);
        $form->handleRequest();
        dump($request->getSession()->all());

要使用csrf选项，请使用选项csrf_protection

$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_protection' => false))
        ->add('task', TextType::class)
        ->add('dueDate', DateType::class)
        ->getForm();

编辑：设置会话

use Symfony\Component\HttpFoundation\Session\Session;
....

    $request = Request::createFromGlobals();
    $formToken = '_csrf/'.$form->getName();
    $session = New Session();
    $session->set($formToken,$csrfManager->getToken($formToken)->getValue());
    $request->setSession($session);
    $form->handleRequest();

如何强制我的表单compoenent在每次加载时生成一个新的csrf？

1 个答案: