ReferrerEnforcer
Evaluates the `Referer` header of a request against the application the request was addressed to.
Deciding whether a referrer is same-origin (= originating from the very same application) cannot
be done generically - the concrete URI details of the addressed application are required for that.
Therefore, this class is abstract and each application (backend, install tool) has to provide its
own resolveReferrerType() implementation.
Table of Contents
Constants
- TYPE_REFERRER_EMPTY : int = 1
- TYPE_REFERRER_SAME_ORIGIN : int = 4
- TYPE_REFERRER_SAME_SITE : int = 2
Methods
- handle() : ResponseInterface|null
- resolveAbsoluteWebPath() : string
- resolveReferrerType() : int
- Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.
- resolveRequestHost() : string
Constants
TYPE_REFERRER_EMPTY
protected
int
TYPE_REFERRER_EMPTY
= 1
TYPE_REFERRER_SAME_ORIGIN
protected
int
TYPE_REFERRER_SAME_ORIGIN
= 4
TYPE_REFERRER_SAME_SITE
protected
int
TYPE_REFERRER_SAME_SITE
= 2
Methods
handle()
public
handle(ServerRequestInterface $request, array<string|int, mixed> $options) : ResponseInterface|null
Parameters
- $request : ServerRequestInterface
- $options : array<string|int, mixed>
Return values
ResponseInterface|nullresolveAbsoluteWebPath()
protected
resolveAbsoluteWebPath(string $target, ServerRequestInterface $request) : string
Parameters
- $target : string
- $request : ServerRequestInterface
Return values
stringresolveReferrerType()
Determines whether the referrer is same-origin (= the very same application), same-site (= the same host, but a different application) or neither of both.
protected
abstract resolveReferrerType(ServerRequestInterface $request) : int
Implementations must not fall back to the request directory to detect same-origin: all applications are served from the same entry script, which would make any same-site referrer appear as same-origin.
Parameters
- $request : ServerRequestInterface
Return values
intresolveRequestHost()
protected
resolveRequestHost(ServerRequestInterface $request) : string
Parameters
- $request : ServerRequestInterface