IBX-833: As a Developer I want to configure CSRF validation in REST endpoints

[adamwojs]

Question	Answer
JIRA issue	IBX-833
Type	improvement
Target version	3.3.7+
BC breaks	no
Tests pass	yes
Doc needed	yes

Allow to configure CSRF validation in REST endpoints using 

csrf_protection: false

attribute in route definition.

Currently to achive the same efect \EzSystems\EzPlatformRestBundle\EventListener\CsrfListener::isSessionRoute needs to be overriden:

class CsrfListener implements EventSubscriberInterface
   # ...
    protected function isSessionRoute($route)
    {
        return in_array(
            $route,
            ['ezpublish_rest_createSession', 'ezpublish_rest_refreshSession', 'ezpublish_rest_deleteSession']
        );
    }
    # ...
}

Example use cases:

• Forgot password implementation via REST

TODO:

• Implement tests.
• Fix new code according to Coding Standards ($ composer fix-cs).
• Ask for Code Review.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[Steveb-p]

Can we use trigger_deprecation from Symfony contracts to log situations where isSessionRoute returns true? Does it make sense?

[alongosz]

Q: doesn't this open us to potential security issue?

[adamwojs]

Q: doesn't this open us to potential security issue?

No, CSRF protection is enabled by default for all POST/PUT/etc endpoints. If you needs to disable CSRF protection (in mentioned use case is required) then you must configure it explicitly.

[alongosz]

Q: doesn't this open us to potential security issue?

No, CSRF protection is enabled by default for all POST/PUT/etc endpoints. If you needs to disable CSRF protection (in mentioned use case is required) then you must configure it explicitly.

My question was rather about is it safe to disable that for session endpoints?

[alongosz]

Clarified during internal sync.