CsrfExceptionSubscriber.php

<?php

declare (strict_types=1);
namespace Drupal\Core\EventSubscriber;

use Drupal\Core\Routing\RouteMatch;
use Drupal\Core\Url;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpKernel\Event\ExceptionEvent;

/**
 * Handles exceptions related to CSRF access.
 *
 * Redirects CSRF 403 exceptions to a _csrf_confirm_form_route.
 */
class CsrfExceptionSubscriber extends HttpExceptionSubscriberBase {
    
    /**
     * {@inheritdoc}
     */
    protected function getHandledFormats() : array {
        return [
            'html',
        ];
    }
    
    /**
     * Handles a 403 error for HTML.
     *
     * @param \Symfony\Component\HttpKernel\Event\ExceptionEvent $event
     *   The event to process.
     */
    public function on403(ExceptionEvent $event) : void {
        $request = $event->getRequest();
        $routeMatch = RouteMatch::createFromRequest($request);
        $route = $routeMatch->getRouteObject();
        if (!$route->hasRequirement('_csrf_token') || empty($route->getOption('_csrf_confirm_form_route'))) {
            return;
        }
        $event->setResponse(new RedirectResponse(Url::fromRoute($route->getOption('_csrf_confirm_form_route'))
            ->toString()));
    }

}