Frank/Escapepage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSRF protection, login throttling, and invite-code rate limiting

Browse Source 
The admin panel already checked CSRF tokens on destructive actions,
but the player-facing raw HTML forms (create/join/leave/start
session, toggle ready, lobby chat, feedback) had none - cookie
SameSite=Lax blunts classic cross-site auto-submit attacks but isn't
a substitute for real tokens. Adds matching csrf_token()/
isCsrfTokenValid() checks to all of them.

Also adds login_throttling (5 attempts/15 min) to stop unlimited
password guessing, and a per-user rate limiter (10/min) on the
invite-code join endpoint, since invite codes are only 32-bit and
had no protection against brute-forcing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Frank
2026-08-10 21:41:47 +02:00
co-authored by Claude Sonnet 5
parent 335697e520
commit 2913b8d2a2
8 changed files with 67 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Game/Controller/GameController.php
+47 -6
View File
@@ -22,6 +22,8 @@ use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\DependencyInjection\Attribute\Autowire;
use Symfony\Component\DependencyInjection\Attribute\Target;
use Symfony\Component\RateLimiter\RateLimiterFactoryInterface;
final class GameController extends AbstractController
{
@@ -39,13 +41,20 @@ final class GameController extends AbstractController
GameRepository $gameRepository,
SessionRepository $sessionRepository,
GameDashboardService $dashboardService,
Security $security
Security $security,
#[Target('invite_code_join')]
RateLimiterFactoryInterface $inviteCodeJoinLimiter
): Response {
$user = $security->getUser();
$isAdmin = $this->isGranted('ROLE_ADMIN');
if ($request->isMethod('POST')) {
if ($request->request->has('create_session')) {
if (!$this->isCsrfTokenValid('create_session', $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
return $this->redirectToRoute('game_dashboard');
}
$gameId = $request->request->get('game_id');
$game = $gameRepository->find($gameId);
@@ -55,6 +64,17 @@ final class GameController extends AbstractController
}
}
} elseif ($request->request->has('join_session')) {
if (!$this->isCsrfTokenValid('join_session', $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
return $this->redirectToRoute('game_dashboard');
}
$limiter = $inviteCodeJoinLimiter->create($user->getUserIdentifier());
if (!$limiter->consume(1)->isAccepted()) {
$this->addFlash('error', 'Too many attempts. Please wait a moment and try again.');
return $this->redirectToRoute('game_dashboard');
}
$inviteCode = $request->request->get('invite_code');
if ($dashboardService->joinSession($inviteCode, $user)) {
$this->addFlash('success', 'Joined session successfully!');
@@ -70,6 +90,11 @@ final class GameController extends AbstractController
return $this->redirectToRoute('game_dashboard');
}
if (!$this->isCsrfTokenValid('create_invite_' . $session->getId(), $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
return $this->redirectToRoute('game_dashboard');
}
$inviteCode = $dashboardService->generateInviteCode($session, $user, $isAdmin);
if ($inviteCode) {
$this->addFlash('success', 'Invite link created: ' . $inviteCode);
@@ -79,6 +104,11 @@ final class GameController extends AbstractController
$session = $sessionRepository->find($sessionId);
if ($session) {
if (!$this->isCsrfTokenValid('leave_session_' . $session->getId(), $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
return $this->redirectToRoute('game_dashboard');
}
if ($dashboardService->leaveSession($session, $user)) {
$this->addFlash('success', 'Left session successfully.');
} else {
@@ -90,6 +120,11 @@ final class GameController extends AbstractController
$session = $sessionRepository->find($sessionId);
if ($session) {
if (!$this->isCsrfTokenValid('start_session_' . $session->getId(), $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
return $this->redirectToRoute('game_dashboard');
}
if ($dashboardService->startSession($session)) {
$this->addFlash('success', 'Session started! Screens have been assigned.');
} else {
@@ -127,7 +162,9 @@ final class GameController extends AbstractController
$player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
if ($request->isMethod('POST') && $request->request->has('toggle_ready')) {
if (!$user->isVerified()) {
if (!$this->isCsrfTokenValid('toggle_ready_' . $session->getId(), $request->request->get('_token'))) {
$this->addFlash('error', 'Invalid CSRF token.');
} elseif (!$user->isVerified()) {
$this->addFlash('error', 'You must verify your email address before you can mark yourself as ready.');
} else {
$dashboardService->toggleReady($session, $user);
@@ -137,12 +174,16 @@ final class GameController extends AbstractController
}
if ($request->isMethod('POST') && $request->request->has('expire_ready')) {
$dashboardService->expireOwnReadyIfDue($session, $user);
if ($this->isCsrfTokenValid('expire_ready_' . $session->getId(), $request->request->get('_token'))) {
$dashboardService->expireOwnReadyIfDue($session, $user);
}
return $this->redirectToRoute('game', ['session' => $session->getId()]);
}
if ($request->isMethod('POST') && $request->request->has('send_message')) {
$dashboardService->postLobbyMessage($session, $user, (string) $request->request->get('content', ''));
if ($this->isCsrfTokenValid('send_message_' . $session->getId(), $request->request->get('_token'))) {
$dashboardService->postLobbyMessage($session, $user, (string) $request->request->get('content', ''));
}
return $this->redirectToRoute('game', ['session' => $session->getId()]);
}
@@ -215,7 +256,7 @@ final class GameController extends AbstractController
$user = $security->getUser();
$player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
if ($request->isMethod('POST')) {
if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
$difficulty = $request->request->get('difficulty');
$entertaining = $request->request->get('entertaining');
$theme = $request->request->get('theme');
@@ -247,7 +288,7 @@ final class GameController extends AbstractController
$user = $security->getUser();
$player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
if ($request->isMethod('POST')) {
if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
$difficulty = $request->request->get('difficulty');
$entertaining = $request->request->get('entertaining');
$theme = $request->request->get('theme');