CsrfTokenManager.php 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2016, ownCloud, Inc.
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Lukas Reschke <lukas@statuscode.ch>
  8. * @author Roeland Jago Douma <roeland@famdouma.nl>
  9. *
  10. * @license AGPL-3.0
  11. *
  12. * This code is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License, version 3,
  14. * as published by the Free Software Foundation.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License, version 3,
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>
  23. *
  24. */
  25. namespace OC\Security\CSRF;
  26. use OC\Security\CSRF\TokenStorage\SessionStorage;
  27. /**
  28. * Class CsrfTokenManager is the manager for all CSRF token related activities.
  29. *
  30. * @package OC\Security\CSRF
  31. */
  32. class CsrfTokenManager {
  33. private SessionStorage $sessionStorage;
  34. private ?CsrfToken $csrfToken = null;
  35. public function __construct(
  36. private CsrfTokenGenerator $tokenGenerator,
  37. SessionStorage $storageInterface,
  38. ) {
  39. $this->sessionStorage = $storageInterface;
  40. }
  41. /**
  42. * Returns the current CSRF token, if none set it will create a new one.
  43. */
  44. public function getToken(): CsrfToken {
  45. if (!\is_null($this->csrfToken)) {
  46. return $this->csrfToken;
  47. }
  48. if ($this->sessionStorage->hasToken()) {
  49. $value = $this->sessionStorage->getToken();
  50. } else {
  51. $value = $this->tokenGenerator->generateToken();
  52. $this->sessionStorage->setToken($value);
  53. }
  54. $this->csrfToken = new CsrfToken($value);
  55. return $this->csrfToken;
  56. }
  57. /**
  58. * Invalidates any current token and sets a new one.
  59. */
  60. public function refreshToken(): CsrfToken {
  61. $value = $this->tokenGenerator->generateToken();
  62. $this->sessionStorage->setToken($value);
  63. $this->csrfToken = new CsrfToken($value);
  64. return $this->csrfToken;
  65. }
  66. /**
  67. * Remove the current token from the storage.
  68. */
  69. public function removeToken(): void {
  70. $this->csrfToken = null;
  71. $this->sessionStorage->removeToken();
  72. }
  73. /**
  74. * Verifies whether the provided token is valid.
  75. */
  76. public function isTokenValid(CsrfToken $token): bool {
  77. if (!$this->sessionStorage->hasToken()) {
  78. return false;
  79. }
  80. return hash_equals(
  81. $this->sessionStorage->getToken(),
  82. $token->getDecryptedValue()
  83. );
  84. }
  85. }