From 2767abe219488e84e2f4b733484d01489c7b0e45 Mon Sep 17 00:00:00 2001 From: Nicolas Grekas Date: Tue, 27 Aug 2024 16:47:41 +0200 Subject: [PATCH] [Security] Don't consider clearing the CSRF token storage as a stateful operation - it's only opportunistic --- .../CsrfTokenClearingLogoutListener.php | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/Symfony/Component/Security/Http/EventListener/CsrfTokenClearingLogoutListener.php b/src/Symfony/Component/Security/Http/EventListener/CsrfTokenClearingLogoutListener.php index 06e791bbfdcd5..f36b7023bdd33 100644 --- a/src/Symfony/Component/Security/Http/EventListener/CsrfTokenClearingLogoutListener.php +++ b/src/Symfony/Component/Security/Http/EventListener/CsrfTokenClearingLogoutListener.php @@ -12,6 +12,7 @@ namespace Symfony\Component\Security\Http\EventListener; use Symfony\Component\EventDispatcher\EventSubscriberInterface; +use Symfony\Component\HttpFoundation\Session\Session; use Symfony\Component\Security\Csrf\TokenStorage\ClearableTokenStorageInterface; use Symfony\Component\Security\Csrf\TokenStorage\SessionTokenStorage; use Symfony\Component\Security\Http\Event\LogoutEvent; @@ -34,7 +35,16 @@ public function onLogout(LogoutEvent $event): void return; } - $this->csrfTokenStorage->clear(); + // Don't consider clearing the CSRF token storage as a stateful operation - it's only opportunistic + $session = $event->getRequest()->getSession(); + $usageIndexValue = $session instanceof Session ? $usageIndexReference = &$session->getUsageIndex() : 0; + $usageIndexReference = \PHP_INT_MIN; + + try { + $this->csrfTokenStorage->clear(); + } finally { + $usageIndexReference = $usageIndexValue; + } } public static function getSubscribedEvents(): array pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy