Add CSRF protection, login throttling, and invite-code rate limiting

The admin panel already checked CSRF tokens on destructive actions,
but the player-facing raw HTML forms (create/join/leave/start
session, toggle ready, lobby chat, feedback) had none - cookie
SameSite=Lax blunts classic cross-site auto-submit attacks but isn't
a substitute for real tokens. Adds matching csrf_token()/
isCsrfTokenValid() checks to all of them.

Also adds login_throttling (5 attempts/15 min) to stop unlimited
password guessing, and a per-user rate limiter (10/min) on the
invite-code join endpoint, since invite codes are only 32-bit and
had no protection against brute-forcing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/packages/framework.yaml

@@ -15,6 +15,12 @@ framework:
         storage_factory_id: session.storage.factory.native
         save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
 
+    rate_limiter:
+        invite_code_join:
+            policy: 'sliding_window'
+            limit: 10
+            interval: '1 minute'
+
 when@prod:
     framework:
         session:

config/packages/security.yaml

@@ -22,6 +22,9 @@ security:
                 enable_csrf: true
                 username_parameter: username
                 password_parameter: password
+            login_throttling:
+                max_attempts: 5
+                interval: '15 minutes'
             logout:
                 path: app_logout
                 # where to redirect after logout

src/Game/Controller/GameController.php

@@ -22,6 +22,8 @@ use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\ExpressionLanguage\Expression;
 use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\DependencyInjection\Attribute\Target;
+use Symfony\Component\RateLimiter\RateLimiterFactoryInterface;
 
 final class GameController extends AbstractController
 {
@@ -39,13 +41,20 @@ final class GameController extends AbstractController
         GameRepository $gameRepository,
         SessionRepository $sessionRepository,
         GameDashboardService $dashboardService,
-        Security $security
+        Security $security,
+        #[Target('invite_code_join')]
+        RateLimiterFactoryInterface $inviteCodeJoinLimiter
     ): Response {
         $user = $security->getUser();
         $isAdmin = $this->isGranted('ROLE_ADMIN');
 
         if ($request->isMethod('POST')) {
             if ($request->request->has('create_session')) {
+                if (!$this->isCsrfTokenValid('create_session', $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $gameId = $request->request->get('game_id');
                 $game = $gameRepository->find($gameId);
 
@@ -55,6 +64,17 @@ final class GameController extends AbstractController
                     }
                 }
             } elseif ($request->request->has('join_session')) {
+                if (!$this->isCsrfTokenValid('join_session', $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
+                $limiter = $inviteCodeJoinLimiter->create($user->getUserIdentifier());
+                if (!$limiter->consume(1)->isAccepted()) {
+                    $this->addFlash('error', 'Too many attempts. Please wait a moment and try again.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $inviteCode = $request->request->get('invite_code');
                 if ($dashboardService->joinSession($inviteCode, $user)) {
                     $this->addFlash('success', 'Joined session successfully!');
@@ -70,6 +90,11 @@ final class GameController extends AbstractController
                     return $this->redirectToRoute('game_dashboard');
                 }
 
+                if (!$this->isCsrfTokenValid('create_invite_' . $session->getId(), $request->request->get('_token'))) {
+                    $this->addFlash('error', 'Invalid CSRF token.');
+                    return $this->redirectToRoute('game_dashboard');
+                }
+
                 $inviteCode = $dashboardService->generateInviteCode($session, $user, $isAdmin);
                 if ($inviteCode) {
                     $this->addFlash('success', 'Invite link created: ' . $inviteCode);
@@ -79,6 +104,11 @@ final class GameController extends AbstractController
                 $session = $sessionRepository->find($sessionId);
 
                 if ($session) {
+                    if (!$this->isCsrfTokenValid('leave_session_' . $session->getId(), $request->request->get('_token'))) {
+                        $this->addFlash('error', 'Invalid CSRF token.');
+                        return $this->redirectToRoute('game_dashboard');
+                    }
+
                     if ($dashboardService->leaveSession($session, $user)) {
                         $this->addFlash('success', 'Left session successfully.');
                     } else {
@@ -90,6 +120,11 @@ final class GameController extends AbstractController
                 $session = $sessionRepository->find($sessionId);
 
                 if ($session) {
+                    if (!$this->isCsrfTokenValid('start_session_' . $session->getId(), $request->request->get('_token'))) {
+                        $this->addFlash('error', 'Invalid CSRF token.');
+                        return $this->redirectToRoute('game_dashboard');
+                    }
+
                     if ($dashboardService->startSession($session)) {
                         $this->addFlash('success', 'Session started! Screens have been assigned.');
                     } else {
@@ -127,7 +162,9 @@ final class GameController extends AbstractController
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
         if ($request->isMethod('POST') && $request->request->has('toggle_ready')) {
-            if (!$user->isVerified()) {
+            if (!$this->isCsrfTokenValid('toggle_ready_' . $session->getId(), $request->request->get('_token'))) {
+                $this->addFlash('error', 'Invalid CSRF token.');
+            } elseif (!$user->isVerified()) {
                 $this->addFlash('error', 'You must verify your email address before you can mark yourself as ready.');
             } else {
                 $dashboardService->toggleReady($session, $user);
@@ -137,12 +174,16 @@ final class GameController extends AbstractController
         }
 
         if ($request->isMethod('POST') && $request->request->has('expire_ready')) {
+            if ($this->isCsrfTokenValid('expire_ready_' . $session->getId(), $request->request->get('_token'))) {
                 $dashboardService->expireOwnReadyIfDue($session, $user);
+            }
             return $this->redirectToRoute('game', ['session' => $session->getId()]);
         }
 
         if ($request->isMethod('POST') && $request->request->has('send_message')) {
+            if ($this->isCsrfTokenValid('send_message_' . $session->getId(), $request->request->get('_token'))) {
                 $dashboardService->postLobbyMessage($session, $user, (string) $request->request->get('content', ''));
+            }
             return $this->redirectToRoute('game', ['session' => $session->getId()]);
         }
 
@@ -215,7 +256,7 @@ final class GameController extends AbstractController
         $user = $security->getUser();
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
-        if ($request->isMethod('POST')) {
+        if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
             $difficulty = $request->request->get('difficulty');
             $entertaining = $request->request->get('entertaining');
             $theme = $request->request->get('theme');
@@ -247,7 +288,7 @@ final class GameController extends AbstractController
         $user = $security->getUser();
         $player = $playerRepository->findOneBy(['session' => $session, 'user' => $user]);
 
-        if ($request->isMethod('POST')) {
+        if ($request->isMethod('POST') && $this->isCsrfTokenValid('game_feedback_' . $session->getId(), $request->request->get('_token'))) {
             $difficulty = $request->request->get('difficulty');
             $entertaining = $request->request->get('entertaining');
             $theme = $request->request->get('theme');

templates/game/dashboard.html.twig

@@ -17,6 +17,7 @@
                 <div class="card-body">
                     {% if availableGames is not empty %}
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('create_session') }}">
                             <select name="game_id" class="form-select mb-3">
                                 {% for game in availableGames %}
                                     <option value="{{ game.id }}">
@@ -40,6 +41,7 @@
                 <div class="card-header bg-secondary text-white">Join Session</div>
                 <div class="card-body">
                     <form method="post" class="d-flex gap-2">
+                        <input type="hidden" name="_token" value="{{ csrf_token('join_session') }}">
                         <input type="text" name="invite_code" class="form-control" placeholder="Enter Invite Code" required>
                         <button type="submit" name="join_session" class="btn btn-primary text-nowrap">Join Session</button>
                     </form>
@@ -81,6 +83,7 @@
                                 <code>{{ inviteCode }}</code>
                             {% else %}
                                 <form method="post" class="d-inline">
+                                    <input type="hidden" name="_token" value="{{ csrf_token('create_invite_' ~ session.id) }}">
                                     <input type="hidden" name="session_id" value="{{ session.id }}">
                                     <button type="submit" name="create_invite" class="btn btn-sm btn-outline-secondary">Generate Invite</button>
                                 </form>
@@ -91,12 +94,14 @@
                             {% if session.status.value == 'created' %}
                                 {% if session.players|length >= session.game.numberOfPlayers %}
                                     <form method="post" class="d-inline">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
                                         <input type="hidden" name="session_id" value="{{ session.id }}">
                                         <button type="submit" name="start_session" class="btn btn-sm btn-success">Start Session</button>
                                     </form>
                                 {% endif %}
                                 {% if session.timer == 0 %}
                                     <form method="post" class="d-inline">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('leave_session_' ~ session.id) }}">
                                         <input type="hidden" name="session_id" value="{{ session.id }}">
                                         <button type="submit" name="leave_session" class="btn btn-sm btn-outline-danger" onclick="return confirm('Are you sure you want to leave this session?')">Leave Session</button>
                                     </form>

templates/game/lobby.html.twig

@@ -29,6 +29,7 @@
 
                     {% if session.players|length >= session.game.numberOfPlayers %}
                         <form method="post" action="{{ path('game_dashboard') }}" class="mb-3">
+                            <input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
                             <input type="hidden" name="session_id" value="{{ session.id }}">
                             <button type="submit" name="start_session" class="btn btn-success">Start Session</button>
                         </form>
@@ -71,6 +72,7 @@
 
                 {% if player %}
                     <form method="post" class="d-flex gap-2">
+                        <input type="hidden" name="_token" value="{{ csrf_token('send_message_' ~ session.id) }}">
                         <input type="text" name="content" class="form-control" placeholder="Type a message&hellip;" maxlength="500" required autocomplete="off">
                         <button type="submit" name="send_message" class="btn btn-primary">Send</button>
                     </form>

templates/game/lost.html.twig

@@ -78,6 +78,7 @@
                     <div class="feedback-form mt-4">
                         <h5>Feedback</h5>
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
                             <div class="mb-3">
                                 <label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
                                 <input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">

templates/game/waiting.html.twig

@@ -63,6 +63,7 @@
                     </div>
                 {% endif %}
                 <form method="post" class="mt-4">
+                    <input type="hidden" name="_token" value="{{ csrf_token('toggle_ready_' ~ session.id) }}">
                     <input type="hidden" name="toggle_ready" value="0">
                     <div class="form-check form-switch mb-3">
                         <input class="form-check-input" type="checkbox" id="toggle_ready" name="toggle_ready" value="1" onchange="this.form.submit()" {{ isReady ? 'checked' : '' }} {{ not app.user.verified ? 'disabled' : '' }}>
@@ -87,6 +88,7 @@
 </div>
 
 <form id="expire-ready-form" method="post" style="display:none">
+    <input type="hidden" name="_token" value="{{ csrf_token('expire_ready_' ~ session.id) }}">
     <input type="hidden" name="expire_ready" value="1">
 </form>
 

templates/game/won.html.twig

@@ -78,6 +78,7 @@
                     <div class="feedback-form mt-4">
                         <h5>Feedback</h5>
                         <form method="post">
+                            <input type="hidden" name="_token" value="{{ csrf_token('game_feedback_' ~ session.id) }}">
                             <div class="mb-3">
                                 <label for="difficulty" class="form-label">How would you rate the difficulty? (<span id="difficulty-val">5</span>/10)</label>
                                 <input type="range" class="form-range" min="1" max="10" step="1" id="difficulty" name="difficulty" value="5" oninput="document.getElementById('difficulty-val').innerText = this.value">