#93 Protect the logout against CSRF

The prepended logout configuration enables enable_csrf (token id `logout`, parameter `_csrf_token`): the logout link
of the EasyAdmin menu (LogoutUrlGenerator) carries the token, /process/logout without a valid token is refused (403).
UPGRADE.md v4.0 completed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: njoubert-cleverage

CHANGELOG.md

@@ -12,7 +12,7 @@ Latest
 * [#91](https://github.com/cleverage/ui-process-bundle/issues/91) `LoginController`: pass `error` and `last_username` (`AuthenticationUtils`) to the login template, so that a failed login displays the error message and keeps the email. Test updated.
 
 ## BC break
-* [#93](https://github.com/cleverage/ui-process-bundle/issues/93) Protect the login form against CSRF: `enable_csrf` on the prepended `form_login` configuration, `csrf_token_intention` passed to the login template, `symfony/security-csrf` declared. Add tests.
+* [#93](https://github.com/cleverage/ui-process-bundle/issues/93) Protect the login form and the logout against CSRF: `enable_csrf` on the prepended `form_login` and `logout` configurations, `csrf_token_intention` passed to the login template, `symfony/security-csrf` declared. Add tests.
 * Please follow [UPGRADE.md v4.0](UPGRADE.md#v40)
 
 v3.0.2

UPGRADE.md

@@ -26,6 +26,28 @@ security:
                 enable_csrf: false
 ```
 
+### CSRF protection of the logout
+
+The `logout` configuration prepended by the bundle now enables `enable_csrf` (token id `logout`, parameter
+`_csrf_token`): `/process/logout` without a valid token is refused (403). The logout link of the UI menu carries the
+token. If you link to the logout from your own templates, use `logout_path()` (or `logout_url()`) instead of
+`path('process_logout')`:
+
+```twig
+<a href="{{ logout_path() }}">Logout</a>
+```
+
+To keep the previous behaviour, disable it on your `main` firewall:
+
+```yaml
+# config/packages/security.yaml
+security:
+    firewalls:
+        main:
+            logout:
+                enable_csrf: false
+```
+
 ## v3.0
 
 ### Import routes

docs/reference/03-users_and_security.md

@@ -25,6 +25,7 @@ security:
                 path: process_logout
                 target: process_login
                 clear_site_data: '*'
+                enable_csrf: true
 ```
 
 So your application firewall must be named `main`. The only required application configuration is a password
@@ -43,6 +44,10 @@ The login form is protected by a CSRF token (token id `authenticate`, parameter
 protection must be enabled (`framework.csrf_protection`, enabled by default when the session is). If you override the
 login template, keep the `_csrf_token` field (the `csrf_token_intention` variable passed by `LoginController`).
 
+The logout is also protected by a CSRF token (token id `logout`, parameter `_csrf_token`): the logout link of the UI
+menu carries it. To link to the logout from your own templates, use `logout_path()` (or `logout_url()`), which adds the
+token, rather than `path('process_logout')`.
+
 Roles
 -----
 

src/DependencyInjection/CleverAgeUiProcessExtension.php

@@ -130,6 +130,7 @@ public function prepend(ContainerBuilder $container): void
                             'path' => 'process_logout',
                             'target' => 'process_login',
                             'clear_site_data' => '*',
+                            'enable_csrf' => true,
                         ],
                     ],
                 ],

tests/DependencyInjection/CleverAgeUiProcessExtensionTest.php

@@ -180,7 +180,7 @@ public function testPrepend(): void
                     'provider' => 'process_user_provider',
                     'custom_authenticator' => ['cleverage_ui_process.security.http_process_execution_authenticator'],
                     'form_login' => ['login_path' => 'process_login', 'check_path' => 'process_login', 'enable_csrf' => true],
-                    'logout' => ['path' => 'process_logout', 'target' => 'process_login', 'clear_site_data' => '*'],
+                    'logout' => ['path' => 'process_logout', 'target' => 'process_login', 'clear_site_data' => '*', 'enable_csrf' => true],
                 ],
             ],
             $security[0]['firewalls']

tests/Functional/SecurityTest.php

@@ -154,10 +154,25 @@ public function testLogout(): void
     {
         $this->login();
 
-        $this->client->request('GET', '/process/logout');
+        // Logout link of the user menu, with the CSRF token
+        $crawler = $this->client->request('GET', '/process/process-execution');
+        $link = $crawler->filter('a[href^="/process/logout?_csrf_token="]');
+        self::assertGreaterThan(0, $link->count());
+        $this->client->click($link->first()->link());
         self::assertResponseRedirects('http://localhost/process/login');
 
         $this->client->request('GET', '/process');
         self::assertResponseRedirects('http://localhost/process/login');
     }
+
+    public function testLogoutWithoutCsrfToken(): void
+    {
+        $this->login();
+
+        $this->client->request('GET', '/process/logout');
+        self::assertResponseStatusCodeSame(403);
+
+        $this->client->request('GET', '/process/process-execution');
+        self::assertResponseIsSuccessful();
+    }
 }