CsrfAccessCheck docblock extremely out of date

Created on 9 March 2023, over 1 year ago
Updated 31 March 2023, about 1 year ago

Problem/Motivation

The docblock for Drupal\Core\Access\CsrfAccessCheck is tremendously outdated and gives incorrect information which I think qualifies this as a bug rather than a task. It reads:

 * To use this check, add a "token" GET parameter to URLs of which the value is
 * a token generated by \Drupal::csrfToken()->get() using the same value as the
 * "_csrf_token" parameter in the route.

That has not been updated a single time since the initial commit of this class back here: #1798296: Integrate CSRF link token directly into routing system

The very next commit seems to have brought reality out of line with the documentation: #2133439: Dynamically create token value string based on route path

At that point the path is used when generating the token, not the _csrf_token parameter.

If we're fast, we can fix this before it's been wrong for a full decade! :)

Proposed resolution

The csrf documentation on drupal.org is pretty darn good: https://www.drupal.org/docs/8/api/routing-system/access-checking-on-rout...

We can probably take the tl;dr; version of that and throw it in the docblock.

Remaining tasks

TBD

User interface changes

Nope

API changes

Nope

Data model changes

Nope

Release notes snippet

Nope

🐛 Bug report
Status

Fixed

Version

9.5

Component
Base 

Last updated 19 minutes ago

Created by

🇺🇸United States danflanagan8 St. Louis, US

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024