不使用Symfony表单组件时，CSRF验证应放何处？移至服务是否合理？

Absolutely, moving your CSRF validation logic out of controllers and into a dedicated service is a fantastic approach—it’s totally aligned with clean code principles, keeps your controllers focused, and makes that validation logic reusable across your app. Let’s break down why this works and how to implement it:

Why This Approach Makes Sense #

• Controllers should stick to HTTP concerns: Controllers are meant to handle request/response flow, coordinate services, and not get bogged down in security or validation logic. Extracting CSRF checks keeps them lean and focused on their core job.
• Reusability: If you need CSRF validation for multiple actions (like delete, update, or form submissions), a dedicated service lets you reuse the exact same logic everywhere instead of duplicating code in every controller method.
• Testability: Services are way easier to unit test than controller methods. You can mock the CSRF token manager and test your validation logic in isolation without dealing with HTTP requests or full controller stacks.

How to Implement This in Symfony #

Here’s a straightforward example to get you started:

1. Create a CSRF Validation Service #

First, build a service that encapsulates the CSRF check logic:

// src/Service/CsrfValidator.php
namespace App\Service;

use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
use Symfony\Component\Security\Csrf\CsrfToken;

class CsrfValidator
{
    public function __construct(private CsrfTokenManagerInterface $csrfTokenManager)
    {
    }

    public function isValid(string $intention, ?string $submittedToken): bool
    {
        if (empty($submittedToken)) {
            return false;
        }

        return $this->csrfTokenManager->isTokenValid(new CsrfToken($intention, $submittedToken));
    }
}

2. Use the Service in Your Controller #

Now inject this service into your controller and use it to validate tokens:

// src/Controller/ItemController.php
namespace App\Controller;

use App\Service\CsrfValidator;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;

class ItemController
{
    public function delete(Request $request, CsrfValidator $csrfValidator): Response
    {
        $submittedToken = $request->request->get('token');
        
        if (!$csrfValidator->isValid('delete-item', $submittedToken)) {
            // Handle invalid token—return 403 or redirect with an error
            return new Response('Invalid CSRF token', Response::HTTP_FORBIDDEN);
        }

        // Proceed with your delete logic (maybe call another service for the actual deletion)
        // ...

        return new Response('Item deleted successfully');
    }
}

Bonus: Automate with Attributes (Symfony 6.2+) #

For larger apps, you can take this a step further by creating a custom attribute and kernel listener to auto-validate CSRF tokens before your controller runs. This removes even more boilerplate from your controllers:

Custom Validation Attribute #

// src/Attribute/ValidateCsrf.php
namespace App\Attribute;

#[\Attribute(\Attribute::TARGET_METHOD)]
class ValidateCsrf
{
    public function __construct(
        public string $intention,
        public string $tokenField = 'token'
    ) {
    }
}

Kernel Listener to Handle the Attribute #

// src/EventListener/CsrfValidationListener.php
namespace App\EventListener;

use App\Attribute\ValidateCsrf;
use App\Service\CsrfValidator;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ControllerEvent;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

class CsrfValidationListener implements EventSubscriberInterface
{
    public function __construct(private CsrfValidator $csrfValidator)
    {
    }

    public function onControllerEvent(ControllerEvent $event): void
    {
        $controller = $event->getController();
        
        // Handle both invokable controllers and controller-method pairs
        if (is_array($controller)) {
            $reflection = new \ReflectionMethod($controller[0], $controller[1]);
        } else {
            $reflection = new \ReflectionFunction($controller);
        }

        $csrfAttribute = $reflection->getAttributes(ValidateCsrf::class)[0] ?? null;
        
        if (!$csrfAttribute) {
            return;
        }

        $validateConfig = $csrfAttribute->newInstance();
        $request = $event->getRequest();
        $submittedToken = $request->request->get($validateConfig->tokenField);

        if (!$this->csrfValidator->isValid($validateConfig->intention, $submittedToken)) {
            throw new AccessDeniedHttpException('Invalid CSRF token');
        }
    }

    public static function getSubscribedEvents(): array
    {
        return [
            ControllerEvent::class => 'onControllerEvent',
        ];
    }
}

Use the Attribute in Your Controller #

Now you can just add the attribute to your controller method, and the listener handles the rest:

// src/Controller/ItemController.php
namespace App\Controller;

use App\Attribute\ValidateCsrf;
use Symfony\Component\HttpFoundation\Response;

class ItemController
{
    #[ValidateCsrf(intention: 'delete-item')]
    public function delete(): Response
    {
        // No manual CSRF check needed!
        // Proceed with delete logic...

        return new Response('Item deleted successfully');
    }
}

Key Things to Keep in Mind #

• Keep intentions unique: Always use a distinct intention string for each action (like 'delete-item', 'update-user') to prevent token reuse across different endpoints.
• Handle invalid tokens properly: Return a 403 Forbidden status or redirect with a user-friendly error message—don’t just silently fail.
• Don’t overengineer: If you only need CSRF validation in a couple of places, stick with the simple service approach. The attribute/listener setup is better for larger apps with many endpoints needing checks.

内容的提问来源于stack exchange，提问作者Dariux