ReferrerEnforcer extends ReferrerEnforcer

Read onlyYes

Treats a referrer as same-origin only if it addresses the install tool entry point (site path plus `__typo3_install` query parameter) - and not merely the same host.

Note this requires the client to submit the query string as part of the Referer header. Deployments that reduce the referrer to its origin only (Referrer-Policy: origin or strict-origin) therefore cannot use the install tool while the feature toggle security.backend.enforceReferrer is enabled.

Internal

Table of Contents

Constants

TYPE_REFERRER_EMPTY  : mixed = 1
TYPE_REFERRER_SAME_ORIGIN  : mixed = 4
TYPE_REFERRER_SAME_SITE  : mixed = 2

Methods

handle()  : ResponseInterface|null
resolveAbsoluteWebPath()  : string
resolveReferrerType()  : int
Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.
resolveRequestHost()  : string

Constants

TYPE_REFERRER_EMPTY

protected mixed TYPE_REFERRER_EMPTY = 1

TYPE_REFERRER_SAME_ORIGIN

protected mixed TYPE_REFERRER_SAME_ORIGIN = 4

TYPE_REFERRER_SAME_SITE

protected mixed TYPE_REFERRER_SAME_SITE = 2

Methods

handle()

public handle(ServerRequestInterface $request, array<string|int, mixed> $options) : ResponseInterface|null
Parameters
$request : ServerRequestInterface
$options : array<string|int, mixed>
Return values
ResponseInterface|null

resolveAbsoluteWebPath()

protected resolveAbsoluteWebPath(string $target, ServerRequestInterface $request) : string
Parameters
$target : string
$request : ServerRequestInterface
Return values
string

resolveReferrerType()

Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.

protected resolveReferrerType(ServerRequestInterface $request) : int

Implementations must not fall back to the request directory to detect same-origin: all applications are served from the same entry script, which would make any same-site referrer appear as same-origin.

Parameters
$request : ServerRequestInterface
Return values
int

resolveRequestHost()

protected resolveRequestHost(ServerRequestInterface $request) : string
Parameters
$request : ServerRequestInterface
Return values
string
On this page

Search results