vendor/symfony/security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php line 38

Open in your IDE?
  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <fabien@symfony.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Component\Security\Http\Firewall;
  14. use Psr\Log\LoggerInterface;
  15. use Symfony\Component\HttpFoundation\Request;
  16. use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
  17. use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface;
  18. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  19. use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
  20. use Symfony\Component\Security\Core\Exception\BadCredentialsException;
  21. use Symfony\Component\Security\Core\Exception\InvalidCsrfTokenException;
  22. use Symfony\Component\Security\Core\Security;
  23. use Symfony\Component\Security\Csrf\CsrfToken;
  24. use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
  25. use Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface;
  26. use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
  27. use Symfony\Component\Security\Http\HttpUtils;
  28. use Symfony\Component\Security\Http\ParameterBagUtils;
  29. use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategyInterface;
  30. use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  32. /**
  33.  * UsernamePasswordFormAuthenticationListener is the default implementation of
  34.  * an authentication via a simple form composed of a username and a password.
  35.  *
  36.  * @author Fabien Potencier <fabien@symfony.com>
  37.  */
  38. class UsernamePasswordFormAuthenticationListener extends AbstractAuthenticationListener
  39. {
  40.     private $csrfTokenManager;
  42.     public function __construct(TokenStorageInterface $tokenStorage, AuthenticationManagerInterface $authenticationManager, SessionAuthenticationStrategyInterface $sessionStrategy, HttpUtils $httpUtils, string $providerKey, AuthenticationSuccessHandlerInterface $successHandler, AuthenticationFailureHandlerInterface $failureHandler, array $options = [], LoggerInterface $logger = null, EventDispatcherInterface $dispatcher = null, CsrfTokenManagerInterface $csrfTokenManager = null)
  43.     {
  44.         parent::__construct($tokenStorage, $authenticationManager, $sessionStrategy, $httpUtils, $providerKey, $successHandler, $failureHandler, array_merge([
  45.             'username_parameter' => '_username',
  46.             'password_parameter' => '_password',
  47.             'csrf_parameter' => '_csrf_token',
  48.             'csrf_token_id' => 'authenticate',
  49.             'post_only' => true,
  50.         ], $options), $logger, $dispatcher);
  52.         $this->csrfTokenManager = $csrfTokenManager;
  53.     }
  55.     /**
  56.      * {@inheritdoc}
  57.      */
  58.     protected function requiresAuthentication(Request $request)
  59.     {
  60.         if ($this->options['post_only'] && !$request->isMethod('POST')) {
  61.             return false;
  62.         }
  64.         return parent::requiresAuthentication($request);
  65.     }
  67.     /**
  68.      * {@inheritdoc}
  69.      */
  70.     protected function attemptAuthentication(Request $request)
  71.     {
  72.         if (null !== $this->csrfTokenManager) {
  73.             $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
  75.             if (!\is_string($csrfToken) || false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
  76.                 throw new InvalidCsrfTokenException('Invalid CSRF token.');
  77.             }
  78.         }
  80.         if ($this->options['post_only']) {
  81.             $username = ParameterBagUtils::getParameterBagValue($request->request, $this->options['username_parameter']);
  82.             $password = ParameterBagUtils::getParameterBagValue($request->request, $this->options['password_parameter']);
  83.         } else {
  84.             $username = ParameterBagUtils::getRequestParameterValue($request, $this->options['username_parameter']);
  85.             $password = ParameterBagUtils::getRequestParameterValue($request, $this->options['password_parameter']);
  86.         }
  88.         if (!\is_string($username) && (!\is_object($username) || !method_exists($username, '__toString'))) {
  89.             throw new BadRequestHttpException(sprintf('The key "%s" must be a string, "%s" given.', $this->options['username_parameter'], \gettype($username)));
  90.         }
  92.         $username = trim($username);
  94.         if (\strlen($username) > Security::MAX_USERNAME_LENGTH) {
  95.             throw new BadCredentialsException('Invalid username.');
  96.         }
  98.         $request->getSession()->set(Security::LAST_USERNAME, $username);
  100.         return $this->authenticationManager->authenticate(new UsernamePasswordToken($username, $password, $this->providerKey));
  101.     }
  102. }