CSRF protection configuration

DependencyInjection/Configuration.php

@@ -28,6 +28,7 @@ public function getConfigTreeBuilder()
                 ->booleanNode('security')->defaultTrue()->info(
                     "Whether or not the SecurityBundle integration should be enabled. Set to false if and only if your app does not use SecurityBundle."
                 )->end()
+                ->booleanNode('csrf_protection')->defaultTrue()->end()
             ->end();
 
         return $treeBuilder;

DependencyInjection/HappyrAuth0Extension.php

@@ -28,6 +28,12 @@ public function load(array $configs, ContainerBuilder $container)
 
         if ($config['security']) {
             $loader->load('security.yml');
+
+            $container->getDefinition('happyr.auth0.security.authentication.entry_point.oauth')
+                ->replaceArgument(4, $config['csrf_protection']);
+
+            $container->getDefinition('happyr.auth0.security.authentication.listener.sso')
+                ->addMethodCall('setCsrfProtection', $config['csrf_protection']);
         }
 
         // Add the secret key as parameter

Resources/config/security.yml

@@ -19,4 +19,5 @@ services:
             - "@security.http_utils"
             - "%auth0.client_id%"
             - "%auth0.domain%"
+            - ~ # CSRF Protection set by configuration
         abstract: true

Security/EntryPoint/SSOEntryPoint.php

@@ -39,35 +39,48 @@ class SSOEntryPoint implements AuthenticationEntryPointInterface
      */
     private $callbackPath;
 
+    /**
+     * @var string
+     */
+    private $csrfProtectionEnabled;
+
     /**
      * @param HttpUtils $httpUtils
      * @param $auth0ClientId
      * @param string $auth0Domain
      */
-    public function __construct(CsrfTokenManager $csrfTokenManager, HttpUtils $httpUtils, $auth0ClientId, $auth0Domain, $callbackPath)
-    {
+    public function __construct(
+        CsrfTokenManager $csrfTokenManager,
+        HttpUtils $httpUtils,
+        $auth0ClientId,
+        $auth0Domain,
+        $callbackPath,
+        $csrfProtectionEnabled = true
+    ) {
         $this->csrfTokenManager = $csrfTokenManager;
         $this->httpUtils = $httpUtils;
         $this->auth0ClientId = $auth0ClientId;
         $this->auth0Domain = $auth0Domain;
         $this->callbackPath = $callbackPath;
+        $this->csrfProtectionEnabled = $csrfProtectionEnabled;
     }
 
     /**
      * {@inheritdoc}
      */
     public function start(Request $request, AuthenticationException $authException = null)
     {
-        $csrfToken = $this->csrfTokenManager->getToken('auth0-sso');
-
         $query = [
             'client_id' => $this->auth0ClientId,
             'redirect_uri' => $this->httpUtils->generateUri($request, $this->callbackPath),
             'response_type' => 'code',
             'language' => $request->getLocale(),
-            'state' => $csrfToken->getValue(),
         ];
 
+        if ($this->csrfProtectionEnabled) {
+            $query['state'] = $this->csrfTokenManager->getToken('auth0-sso')->getValue();
+        }
+
         return new RedirectResponse(sprintf('https://%s/authorize?%s', $this->auth0Domain, http_build_query($query)));
     }
 }

Security/Firewall/SSOListener.php

@@ -32,6 +32,11 @@ class SSOListener extends AbstractAuthenticationListener
      */
     private $csrfTokenManager;
 
+    /**
+     * @var bool
+     */
+    private $csrfProtectionEnabled = true;
+
     public function setCsrfTokenManager(CsrfTokenManager $csrfTokenManager)
     {
         $this->csrfTokenManager = $csrfTokenManager;
@@ -45,6 +50,11 @@ public function setAuthenticationApi($authenticationApi)
         $this->authenticationApi = $authenticationApi;
     }
 
+    public function setCsrfProtection($protectionEnabled = true)
+    {
+        $this->csrfProtectionEnabled = $protectionEnabled;
+    }
+
     /**
      * @param string $callbackPath
      *
@@ -63,12 +73,14 @@ protected function attemptAuthentication(Request $request)
             throw new AuthenticationException('No oauth code in the request.');
         }
 
-        if (null === $state = $request->query->get('state')) {
-            throw new AuthenticationException('No state in the request.');
-        }
+        if ($this->csrfProtectionEnabled) {
+            if (null === $state = $request->query->get('state')) {
+                throw new AuthenticationException('No state in the request.');
+            }
 
-        if (!$this->csrfTokenManager->isTokenValid(new CsrfToken('auth0-sso', $state))) {
-            throw new AuthenticationException('Invalid CSRF token');
+            if (!$this->csrfTokenManager->isTokenValid(new CsrfToken('auth0-sso', $state))) {
+                throw new AuthenticationException('Invalid CSRF token');
+            }
         }
 
         $tokenStruct = $this->authenticationApi