function QuickEditController::checkCsrf

Throws an AccessDeniedHttpException if the request fails CSRF validation.

This is used instead of \Drupal\Core\Access\CsrfAccessCheck, in order to allow access for anonymous users.

@todo Refactor this to an access checker.

File

core/modules/quickedit/src/QuickEditController.php, line 172

Class

QuickEditController

Returns responses for Quick Edit module routes.

Namespace

Code

private static function checkCsrf(Request $request, AccountInterface $account) {
  $header = 'X-Drupal-Quickedit-CSRF-Token';
  if (!$request->headers
    ->has($header)) {
    throw new AccessDeniedHttpException();
  }
  if ($account->isAnonymous()) {
    // For anonymous users, just the presence of the custom header is
    // sufficient protection.
    return;
  }
  // For authenticated users, validate the token value.
  $token = $request->headers
    ->get($header);
  if (!\Drupal::csrfToken()->validate($token, $header)) {
    throw new AccessDeniedHttpException();
  }
}