我有一个用 Symfony 2.8.11 和 FosUserBundle 2.0.0-beta1 编写的应用程序。 用户可以通过 VPN 或基本身份验证连接到站点。他们大多在 Windows 7 上使用 Internet Explorer 11。 他们中的一些人在站点内以随机形式遇到无效的 CSRF token 问题。问题是用户无法提交表单，即使刷新几次页面也是如此。

我怀疑是session不断刷新导致的问题，从日志看:

{
    "created":1483610056, 
    "lastUsed":1483610056
} ["csrf","session_times"] []

另外，我怀疑是remember me token认证导致的(每个issue都经​​过了那个token的认证):

[2017-01-05 10:54:16] security.DEBUG: Remember-me cookie detected. [] []
[2017-01-05 10:54:16] security.INFO: Remember-me cookie accepted. [] []
[2017-01-05 10:54:16] security.DEBUG: Populated the token storage with a remember-me token. [] []

我的安全配置:

...
main:
    pattern: ^/
    form_login:
        provider: fos_userbundle
        csrf_token_generator: security.csrf.token_manager
        # if you are using Symfony < 2.8, use the following config instead:
        # csrf_provider: form.csrf_provider
    logout:       true
    anonymous:    true
    remember_me:
        name: "%session_cookie_remember_name%"
        domain: "%session_cookie_domain%"
        key:      "%secret%"
        lifetime: 604800
        path:     /
    switch_user: true
...

是否有可能在每次加载页面时重新启动 session 并记住我对其进行身份验证？是错误还是正确的行为？我怎样才能摆脱 csrf 无效 token 问题？

问题到达时来自一页请求的完整日志:

[2017-01-05 10:54:16] request.INFO: Matched route "fos_user_profile_show". 
{
    "route_parameters":{
    "_controller":"AppBundle\\Controller\\ProfileController::showAction",
    "lang":"pl",
    "_route":"fos_user_profile_show"
    },
    "request_uri":"..."
} []
[2017-01-05 10:54:16] security.DEBUG: Remember-me cookie detected. [] []
[2017-01-05 10:54:16] security.INFO: Remember-me cookie accepted. [] []
[2017-01-05 10:54:16] security.DEBUG: Populated the token storage with a remember-me token. [] []
[2017-01-05 10:54:16] app.DEBUG: 
{
    "USER":"www-data",
    "HOME":"\/var\/www",
    "HTTP_COOKIE":"safeId=51081905; nlPopup=shown; cookieInfo=1; __cfduid=d7b03b629331902c712642a374b52b3711476715148; auth=1a2dd1f7a8b16bf7d31988bf968748b5; VMREMEMBERME=QXBwQnVuZGxlXEVudGl0eVxVc2VyOmMydHNaWEF6TkRKQVluSmhibVJpY1M1d2JBPT06MTQ4NDA1MjAxNzoyODM1NWViMThkN2EwMDQ2MGUzNzVmNzg4ZGYwYWE2NzliNTcwOGJiY2E4ZDk0ZGE4YzJhZTFmZTRlMThlMjhh; VMSESSID=4oupq2fgt72vc8lnqff0g9op44",
    "HTTP_CONNECTION":"Keep-Alive",
    "HTTP_DNT":"1",
    "HTTP_HOST":"sub.domain.com",
    "HTTP_ACCEPT_ENCODING":"gzip, deflate",
    "HTTP_USER_AGENT":"Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko",
    "HTTP_ACCEPT_LANGUAGE":"pl-PL",
    "HTTP_ACCEPT":"text\/html, application\/xhtml+xml, *\/*",
    "SCRIPT_FILENAME":"\/data\/www\/project\/web\/app.php",
    "REDIRECT_STATUS":"200",
    "SERVER_NAME":"sub.domain.com",
    "SERVER_PORT":"80",
    "SERVER_ADDR":"x.x.x.x",
    "REMOTE_PORT":"x",
    "REMOTE_ADDR":"x.x.x.x",
    "SERVER_SOFTWARE":"nginx\/1.10.0",
    "GATEWAY_INTERFACE":"CGI\/1.1",
    "REQUEST_SCHEME":"http",
    "SERVER_PROTOCOL":"HTTP\/1.1",
    "DOCUMENT_ROOT":"\/data\/www\/project\/web",
    "DOCUMENT_URI":"\/app.php",
    "REQUEST_URI":"...",
    "SCRIPT_NAME":"\/app.php",
    "CONTENT_LENGTH":"",
    "CONTENT_TYPE":"",
    "REQUEST_METHOD":"GET",
    "QUERY_STRING":"...",
    "FCGI_ROLE":"RESPONDER",
    "PHP_SELF":"\/app.php",
    "REQUEST_TIME_FLOAT":1483610056.9177,
    "REQUEST_TIME":1483610056
} ["csrf","server"] []
[2017-01-05 10:54:16] app.DEBUG: 
{
    "safeId":"51081905",
    "nlPopup":"shown",
    "cookieInfo":"1",
    "__cfduid":"d7b03b629331902c712642a374b52b3711476715148",
    "auth":"1a2dd1f7a8b16bf7d31988bf968748b5",
    "VMREMEMBERME":"QXBwQnVuZGxlXEVudGl0eVxVc2VyOmMydHNaWEF6TkRKQVluSmhibVJpY1M1d2JBPT06MTQ4NDA1MjAxNzoyODM1NWViMThkN2EwMDQ2MGUzNzVmNzg4ZGYwYWE2NzliNTcwOGJiY2E4ZDk0ZGE4YzJhZTFmZTRlMThlMjhh",
    "VMSESSID":"4oupq2fgt72vc8lnqff0g9op44"
} ["csrf","cookies"] []
[2017-01-05 10:54:16] app.DEBUG: 
{
    "cookie":[
        "safeId=51081905; nlPopup=shown; cookieInfo=1; __cfduid=d7b03b629331902c712642a374b52b3711476715148; auth=1a2dd1f7a8b16bf7d31988bf968748b5; VMREMEMBERME=QXBwQnVuZGxlXEVudGl0eVxVc2VyOmMydHNaWEF6TkRKQVluSmhibVJpY1M1d2JBPT06MTQ4NDA1MjAxNzoyODM1NWViMThkN2EwMDQ2MGUzNzVmNzg4ZGYwYWE2NzliNTcwOGJiY2E4ZDk0ZGE4YzJhZTFmZTRlMThlMjhh; VMSESSID=4oupq2fgt72vc8lnqff0g9op44"
    ],
    "connection":[
        "Keep-Alive"
    ],
    "dnt":[
        "1"
    ],
    "host":[
        "sub.domain.com"
    ],
    "accept-encoding":[
        "gzip, deflate"
    ],
    "user-agent":[
        "Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko"
    ],
    "accept-language":[
        "pl-PL"
    ],
    "accept":[
        "text\/html, application\/xhtml+xml, *\/*"
    ],
    "content-length":[
        ""
    ],
    "content-type":[
        ""
    ],
    "x-php-ob-level":[
        1
    ]
} ["csrf","headers"] []
[2017-01-05 10:54:16] app.DEBUG: [] ["csrf","session"] []
[2017-01-05 10:54:16] app.DEBUG: 
{
    "created":1483610056,
    "lastUsed":1483610056
} ["csrf","session_times"] []
[2017-01-05 10:54:16] app.DEBUG: 
{
    "name":"xxx",
    "address":"xxx",
    "city":"xxx",
    "phoneNumber":"xxx",
    "lang":"xx",
    "save":"",
    "_token":"ms-TX5_Du6lh3BqV2RB2CvQaEJ8WzuPBCeduAJox3ik"
} ["csrf","data"] []
[2017-01-05 10:54:16] security.DEBUG: Stored the security token in the session. {"key":"_security_main"} []

最佳答案

我明白你的意思了，有时这种情况是由于 csrf 生成器造成的。您必须更改 config.yml 文件并注释 csrf 生成器行，例如

...
main:
    pattern: ^/
    form_login:
        provider: fos_userbundle
        #csrf_token_generator: security.csrf.token_manager
        # if you are using Symfony < 2.8, use the following config instead:
        # csrf_provider: form.csrf_provider
    logout:       true
    anonymous:    true
    remember_me:
        name: "%session_cookie_remember_name%"
        domain: "%session_cookie_domain%"
        key:      "%secret%"
        lifetime: 604800
        path:     /
    switch_user: true
...

现在它们不是 csrf token 的条件。

关于php - Symfony2 : Invalid CSRF token while remember me authentication，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/41482939/