Fix generating logout link with stateless csrf

pierredup · nicolas-grekas · commit 9e5e32b8b96e · 2025-10-13T11:30:10.000+02:00
diff --git a/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php b/src/Symfony/Component/Security/Http/Firewall/LogoutListener.php
@@ -69,7 +69,7 @@ public function authenticate(RequestEvent $event): void
         $request = $event->getRequest();
 
         if (null !== $this->csrfTokenManager) {
-            $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter']);
+            $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $this->options['csrf_parameter'], $request->request->all());
 
             if (!\is_string($csrfToken) || false === $this->csrfTokenManager->isTokenValid(new CsrfToken($this->options['csrf_token_id'], $csrfToken))) {
                 throw new LogoutException('Invalid CSRF token.');
diff --git a/src/Symfony/Component/Security/Http/Tests/Firewall/LogoutListenerTest.php b/src/Symfony/Component/Security/Http/Tests/Firewall/LogoutListenerTest.php
@@ -20,6 +20,7 @@
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Exception\LogoutException;
+use Symfony\Component\Security\Csrf\CsrfToken;
 use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Symfony\Component\Security\Http\Event\LogoutEvent;
 use Symfony\Component\Security\Http\Firewall\LogoutListener;
@@ -88,6 +89,49 @@ public function testHandleMatchedPathWithCsrfValidation()
         $this->assertSame($response, $event->getResponse());
     }
 
+    public function testHandleMatchedPathWithCsrfInQueryParamAndBody()
+    {
+        $tokenManager = $this->getTokenManager();
+        $dispatcher = $this->getEventDispatcher();
+
+        [$listener, $tokenStorage, $httpUtils, $options] = $this->getListener($dispatcher, $tokenManager);
+
+        $request = new Request();
+        $request->query->set('_csrf_token', 'token');
+        $request->request->set('_csrf_token', 'token2');
+
+        $httpUtils->expects($this->once())
+            ->method('checkRequestPath')
+            ->with($request, $options['logout_path'])
+            ->willReturn(true);
+
+        $tokenManager->expects($this->once())
+            ->method('isTokenValid')
+            ->with($this->callback(function ($token) {
+                return $token instanceof CsrfToken && 'token2' === $token->getValue();
+            }))
+            ->willReturn(true);
+
+        $response = new Response();
+        $dispatcher->addListener(LogoutEvent::class, function (LogoutEvent $event) use ($response) {
+            $event->setResponse($response);
+        });
+
+        $tokenStorage->expects($this->once())
+            ->method('getToken')
+            ->willReturn($token = $this->getToken());
+
+        $tokenStorage->expects($this->once())
+            ->method('setToken')
+            ->with(null);
+
+        $event = new RequestEvent($this->createMock(HttpKernelInterface::class), $request, HttpKernelInterface::MAIN_REQUEST);
+
+        $listener($event);
+
+        $this->assertSame($response, $event->getResponse());
+    }
+
     public function testHandleMatchedPathWithoutCsrfValidation()
     {
         $dispatcher = $this->getEventDispatcher();
