ReferrerEnforcer

Read onlyYes
AbstractYes

Evaluates the `Referer` header of a request against the application the request was addressed to.

Deciding whether a referrer is same-origin (= originating from the very same application) cannot be done generically - the concrete URI details of the addressed application are required for that. Therefore, this class is abstract and each application (backend, install tool) has to provide its own resolveReferrerType() implementation.

Internal

Table of Contents

Constants

TYPE_REFERRER_EMPTY  : mixed = 1
TYPE_REFERRER_SAME_ORIGIN  : mixed = 4
TYPE_REFERRER_SAME_SITE  : mixed = 2

Methods

handle()  : ResponseInterface|null
resolveAbsoluteWebPath()  : string
resolveReferrerType()  : int
Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.
resolveRequestHost()  : string

Constants

TYPE_REFERRER_EMPTY

protected mixed TYPE_REFERRER_EMPTY = 1

TYPE_REFERRER_SAME_ORIGIN

protected mixed TYPE_REFERRER_SAME_ORIGIN = 4

TYPE_REFERRER_SAME_SITE

protected mixed TYPE_REFERRER_SAME_SITE = 2

Methods

handle()

public handle(ServerRequestInterface $request, array<string|int, mixed> $options) : ResponseInterface|null
Parameters
$request : ServerRequestInterface
$options : array<string|int, mixed>
Return values
ResponseInterface|null

resolveAbsoluteWebPath()

protected resolveAbsoluteWebPath(string $target, ServerRequestInterface $request) : string
Parameters
$target : string
$request : ServerRequestInterface
Return values
string

resolveReferrerType()

Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.

protected abstract resolveReferrerType(ServerRequestInterface $request) : int

Implementations must not fall back to the request directory to detect same-origin: all applications are served from the same entry script, which would make any same-site referrer appear as same-origin.

Parameters
$request : ServerRequestInterface
Return values
int

resolveRequestHost()

protected resolveRequestHost(ServerRequestInterface $request) : string
Parameters
$request : ServerRequestInterface
Return values
string
On this page

Search results