Add CsrfTokenCookieMiddleware

[vjik]

Q	A
Is bugfix?	❌
New feature?	✔️
Breaks BC?	❌
Fix #99

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b5c9377-0f7e-4418-ab69-cf5c0a883865

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (7db5e85) to head (907ed93).

Additional details and impacted files

@@             Coverage Diff             @@
##              master      #100   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity        72        91   +19     
===========================================
  Files             10        11    +1     
  Lines            196       244   +48     
===========================================
+ Hits             196       244   +48     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds middleware that publishes CSRF tokens in response cookies for SPA cookie-to-header workflows.

Changes:

• Adds configurable CSRF token cookie middleware.
• Adds middleware tests and usage documentation.
• Simplifies null-default handling.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/CsrfTokenCookieMiddleware.php	Implements cookie publication.
tests/CsrfTokenCookieMiddlewareTest.php	Tests cookie behavior.
README.md	Documents configuration and usage.
CHANGELOG.md	Records the feature.
src/StubCsrfToken.php	Simplifies token initialization.
tests/ConfigTest.php	Simplifies default parameter loading.

Suppressed comments (1)

README.md:626

• This copyable configuration is invalid and registers the publisher twice: // or does not make the first entry alternative, and the second definition has no class value. It also places both publisher entries inside the validator, so rejected unsafe requests receive no token cookie. Keep one configured publisher before the validator and specify its class.

    CsrfTokenCookieMiddleware::class,
    // or
    [
        'class' => ,

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/CsrfTokenCookieMiddleware.php:63

• Issue #99 explicitly requires HttpOnly to be configurable, but this constructor has no such option and the header builder can never emit the attribute. Add a boolean option (defaulting to false for the cookie-to-header use case), append HttpOnly when enabled, and cover/document both settings.

    public function __construct(
        CsrfTokenInterface $token,
        string $cookieName = self::COOKIE_NAME,
        string $path = '/',
        ?string $domain = null,
        bool $secure = true,
        ?string $sameSite = self::SAME_SITE_LAX

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/CsrfTokenCookieMiddleware.php:45

• This whitelist contains literal spaces, so names such as X SRF pass even though whitespace is forbidden in cookie names. The $ anchor also permits a final LF, which can produce an invalid or injectable Set-Cookie header. Remove the formatting spaces and use an absolute end anchor.

    private const PATTERN_COOKIE_NAME = '/^[a-zA-Z0-9!#$%&\' * +\- .^_`|~]+$/';

src/CsrfTokenCookieMiddleware.php:78

• Issue #99 explicitly requires a configurable HttpOnly option, but the constructor has no such parameter and the builder never emits HttpOnly. Add a boolean option (defaulting to false for the JavaScript-readable use case) and serialize, test, and document it so the requested API is complete.

        ?string $sameSite = self::SAME_SITE_LAX

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/CsrfTokenCookieMiddleware.php:98

• This check only rejects control characters and semicolons; it accepts values such as an empty string, https://example.com, or not a domain. Those values are not valid RFC 6265 domain-values, so they are serialized into a Set-Cookie header that browsers reject instead of triggering the documented InvalidArgumentException. Validate the domain grammar (while accounting for supported host forms) and add invalid-domain cases.

        if ($domain !== null && preg_match(self::PATTERN_INVALID_ATTRIBUTE_VALUE, $domain)) {
            throw new InvalidArgumentException(
                sprintf('The cookie domain "%s" contains invalid characters.', $domain),
            );
        }

src/CsrfTokenCookieMiddleware.php:80

• Issue #99 explicitly requires HttpOnly to be configurable, but the public constructor has no such option and the header builder can never emit the attribute. Add an httpOnly option (defaulting to false for SPA compatibility), serialize HttpOnly when enabled, and cover/document both settings.

        bool $secure = true,
        ?string $sameSite = self::SAME_SITE_LAX

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (3)

Previously missed (1) — in code that hasn't changed since the last review.

src/CsrfTokenCookieMiddleware.php:31

• The linked double-submit-cookie pattern validates a value derived from the request cookie, while this middleware explicitly never treats that cookie as proof and instead submits the token through a custom header. Pointing to the custom-request-header guidance avoids documenting this as a different CSRF pattern.

 * @link https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#alternative-using-a-double-submit-cookie-pattern

src/CsrfTokenCookieMiddleware.php:76

• Issue #99 explicitly requires a configurable HttpOnly option, but this API always emits a JavaScript-readable cookie and provides no way to enable the attribute. Add a boolean option (defaulting to false), emit HttpOnly conditionally, and cover/document both settings.

        string $cookieName = self::COOKIE_NAME,
        string $path = '/',
        ?string $domain = null,
        bool $secure = true,
        ?string $sameSite = self::SAME_SITE_LAX

src/CsrfTokenCookieMiddleware.php:78

• This validation still accepts an empty name and cookie separators such as = or spaces. For example, configuring foo=bar emits foo=bar=<token>, which creates a cookie named foo rather than foo=bar. Validate the name against the RFC cookie-name token grammar, not only header-injection characters.

        if (preg_match(self::PATTERN_HEADER_INJECTION, $cookieName)) {

[terabytesoftw]

It would be great if we could use autodetect in the secure option, so the user wouldn't have to configure anything.

$secure = $this->secure ?? strtolower($request->getUri()->getScheme()) === 'https';

This is how it works both in development with localhost and for production environments.

[vjik]

done

[samdark]

Should it include = as well?

[vjik]

= only matters for cookieName, but this pattern also validates path and domain, where = is. This class doesn't aim to fully validate cookie attributes against the RFC — only to keep the response header safe from
injection. So = doesn't belong here.

[samdark]

Likely needs Cache-Control/Vary for GET to mark the response as non-cacheable.

[vjik]

done

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

src/CsrfTokenCookieMiddleware.php:95

• Issue #99 explicitly requires the cookie's HttpOnly option to be configurable, but the new constructor exposes no such option and the generated header can never include HttpOnly. Add a boolean constructor option (defaulting to false for the JavaScript-readable use case) and apply it when building the cookie header.

        ?string $domain = null,
        ?bool $secure = null,
        ?string $sameSite = self::SAME_SITE_LAX,
        $cacheControl = true

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/CsrfTokenCookieMiddleware.php:96

• Issue #99 explicitly requires the response-cookie feature to support a configurable HttpOnly option, but the constructor exposes no such setting and cookie serialization never emits the attribute. Add an option (defaulting to false so the SPA use case remains JavaScript-readable), serialize it, and document/test both values.

        ?bool $secure = null,
        ?string $sameSite = self::SAME_SITE_LAX,
        $cacheControl = true