ApiCsrfMiddleware.inc.php

<?php
 
class ApiCsrfMiddleware {
 
   protected $_handler = null;
 
   public function __construct(APIHandler $handler) {
      $this->_handler = $handler;
   }
 
   public function __invoke($slimRequest, $response, $next) {
      if ($this->_isCSRFRequired($slimRequest) && !$this->_isCSRFValid($slimRequest)) {
         return $response->withJson([
            'error' => 'form.csrfInvalid',
            'errorMessage' => __('form.csrfInvalid'),
         ], 403);
      }
      $response = $next($slimRequest, $response);
      return $response;
   }
 
   protected function _isCSRFRequired($slimRequest) {
      if ($this->_handler->getApiToken()) {
         return false;
      }
      $server = $slimRequest->getServerParams();
      return !empty($server['REQUEST_METHOD']) && in_array($server['REQUEST_METHOD'], ['POST', 'PUT', 'DELETE']);
   }
 
   protected function _isCSRFValid($slimRequest) {
      $server = $slimRequest->getServerParams();
      if (empty($server['HTTP_X_CSRF_TOKEN'])) {
         return false;
      }
      $session = Application::get()->getRequest()->getSession();
      return $session && $session->getCSRFToken() === $server['HTTP_X_CSRF_TOKEN'];
   }
}