vendor/symfony/security-http/Firewall/UsernamePasswordFormAuthenticationListener.php line 38

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <fabien@symfony.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Component\Security\Http\Firewall;
  14. use Psr\Log\LoggerInterface;
  15. use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  16. use Symfony\Component\HttpFoundation\Request;
  17. use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
  18. use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
  19. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  20. use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
  21. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  22. use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
  23. use Symfony\Component\Security\Core\Security;
  24. use Symfony\Component\Security\Csrf\CsrfToken;
  25. use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
  26. use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
  27. use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
  28. use Symfony\Component\Security\Http\HttpUtils;
  29. use Symfony\Component\Security\Http\ParameterBagUtils;
  30. use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface;
  32. /**
  33.  * UsernamePasswordFormAuthenticationListener is the default implementation of
  34.  * an authentication via a simple form composed of a username and a password.
  35.  *
  36.  * @author Fabien Potencier <fabien@symfony.com>
  37.  */
  38. class UsernamePasswordFormAuthenticationListener extends AbstractAuthenticationListener {
  40.     private $csrfTokenManager;
  42.     public function __construct(TokenStorageInterface $tokenStorage, AuthenticationManagerInterface $authenticationManager, SessionAuthenticationStrategyInterface $sessionStrategy, HttpUtils $httpUtils, string $providerKey, AuthenticationSuccessHandlerInterface $successHandler, AuthenticationFailureHandlerInterface $failureHandler, array $options = [], LoggerInterface $logger = null, EventDispatcherInterface $dispatcher = null, CsrfTokenManagerInterface $csrfTokenManager = null) {
  43.         parent::__construct($tokenStorage, $authenticationManager, $sessionStrategy, $httpUtils, $providerKey, $successHandler, $failureHandler, array_merge([
  44.             'username_parameter' => '_username',
  45.             'password_parameter' => '_password',
  46.             'csrf_parameter' => '_csrf_token',
  47.             'csrf_token_id' => 'authenticate',
  48.             'post_only' => true,
  49.                         ], $options), $logger, $dispatcher);
  51.         $this->csrfTokenManager = $csrfTokenManager;
  52.     }
  54.     /**
  55.      * {@inheritdoc}
  56.      */
  57.     protected function requiresAuthentication(Request $request) {
  58.         if ($this->options['post_only'] && !$request->isMethod('POST')) {
  59.             return false;
  60.         }
  62.         return parent::requiresAuthentication($request);
  63.     }
  65.     /**
  66.      * {@inheritdoc}
  67.      */
  68.     protected function attemptAuthentication(Request $request) {
  69.         if (null !== $this->csrfTokenManager) {
  70.             $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
  72.             if (false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
  73.                 throw new InvalidCsrfTokenException('Invalid CSRF token.');
  74.             }
  75.         }
  77.         if ($this->options['post_only']) {
  78.             $username = ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']);
  79.             $password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
  80.         } else {
  81.             $username = ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']);
  82.             $password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
  83.         }
  85.         if (!\is_string($username) && (!\is_object($username) || !method_exists($username, '__toString'))) {
  86.             throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
  87.         }
  89.         $username = trim($username);
  91.         if (\strlen($username) > Security::MAX_USERNAME_LENGTH) {
  92.             throw new BadCredentialsException('Invalid username.');
  93.         }
  95.         $request->getSession()->set(Security::LAST_USERNAME, $username);
  97.         return $this->authenticationManager->authenticate(new UsernamePasswordToken($username, $password, $this->providerKey));
  98.     }
  100. }