"nojs"/"ajax" route parameter in use-ajax link breaks CSRF protection

confirmig #50 did it for me.
Thank you

Couple of things:

1. +++ b/core/lib/Drupal/Core/Access/RouteProcessorCsrfAjax.php
   @@ -0,0 +1,73 @@
   + * Processes outbound ajax/nojs route to handle the CSRF token.
   

   This needs documentation to explain why this class is different from the parent.

2. +++ b/core/lib/Drupal/Core/Access/RouteProcessorCsrfAjax.php
   @@ -0,0 +1,73 @@
   +  public function processOutbound($route_name, Route $route, array &$parameters, BubbleableMetadata $bubbleable_metadata = NULL) {
   

   This method looks the same as in the parent?

I agree the idea to have specific access for Ajax should be a good idea, except reading actual code, this does not provide more or less feature, only duplicate code.

Current patch does not work anymore, and taking care of #60 make me wonder if all this duplicate stuff is really needed.

Why we do not need _csrf_ajax_token ?

Using _csrf_ajax_token, we have to create both RouteProcessorCsrfAjax and CsrfAjaxAccessCheck which do exactly the same thing as _csrf_token.

_csrf_exclude_parameters is enough to solve the issue, like it's already in use in https://git.drupalcode.org/project/vote_up_down/-/blob/8.x-1.x/vud.routi...

So instead of adding both _csrk_ajax_token and/or _csrf_exclude_parameters, the second one should be enough for less code.

I put this in MR instead of keeping on old patchs.

goz → changed the visibility of the branch 2670798-nojsajax-route-parameter-10.4.x to hidden.

With 2670798-50.patch I am getting

Path: /flag/unflag/like/11969/default?destination=/node/6%3Fpage%3D%252C%252C%252C%252C%252C%252C%252C%252C%252C%252C%252C%252C%252C1&token=awoKBYgqrejo2wsK3kmJH7iOzWluofZsoXUmcbeyv0E&_wrapper_format=drupal_ajax. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: 'csrf_token' URL query argument is invalid. in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 120 of /var/www/html/test/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).

This error comes with views and infinity scroll, and for some of those flags which the views infinity loads after user scrolls down enough that it initiates a load of new content. So the first nodes which have flags are working, but some of the new do not work.

I am adding the patch file instead of using a PR in the composer.json file for PR #11146 in Drupal 10.4.3 with PHP 8.3.