Skip to content

Commit

Permalink
small changes request token (#5270)
Browse files Browse the repository at this point in the history
  • Loading branch information
franzholz authored Jan 28, 2025
1 parent be76684 commit b526f61
Showing 1 changed file with 6 additions and 6 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -15,18 +15,18 @@ main scope is to ensure a user actually has visited a page, before submitting
data to the webserver.

This token can only be used for HTTP methods `POST`, `PUT` or `PATCH`, but
for instance not for `GET` request.
for instance not for a `GET` request.

The :php:`\TYPO3\CMS\Core\Middleware\RequestTokenMiddleware` resolves
request tokens and nonce values from a request and enhances responses with
a nonce value in case the underlying application issues one. Both items are
serialized as a `JSON Web Token (JWT)`_ hash signed with `HS256`. Request tokens
use the provided nonce value during signing.

Session cookie names involved for providing the nonce value:
Session cookie names involved for providing the `nonce`_ value depending on the request:

* `typo3nonce_[hash]` in case request served with plain HTTP
* `__Secure-typo3nonce_[hash]` in case request served with secured HTTPS
* `typo3nonce_[hash]` - plain HTTP
* `__Secure-typo3nonce_[hash]` - secured HTTPS

Submitting request token value to application:

Expand Down Expand Up @@ -66,8 +66,8 @@ The sequence looks like the following:
:php:`\TYPO3\CMS\Core\Context\SecurityAspect`.

.. versionchanged:: 13.3
Use the :ref:`generic-view-factory` to create a view, previously
used :php:`\TYPO3\CMS\Fluid\View\StandaloneView` was deprecated with
:ref:`generic-view-factory` to create a view. The previously
used :php:`\TYPO3\CMS\Fluid\View\StandaloneView` is deprecated with
TYPO3 v13.3 and removed with TYPO3 v14.0.

.. literalinclude:: _CSRFlikeRequestTokenHandling/_MyController.php
Expand Down

0 comments on commit b526f61

Please sign in to comment.