symfony/symfony — pull request #3006 by jmikola (2011-12-31 06:23:16+00:00)
Title: [Security] Implement support for CSRF tokens in logout URL's

```
Bug fix: no
Feature addition: yes
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: -
Todo: Resolve merge conflicts when integrating this into the master branch
```

This exposes new configuration options to the logout listener to enable CSRF protection, as already exists for the form login listener. The individual commits and their extended messages should suffice for explaining the logical changes of the PR.

In addition to changing LogoutListener, I also created a templating helper to generate logout URL's, which includes a CSRF token if necessary. This may or may not using routing, depending on how the listener is configured since both route names or hard-coded paths are valid options.

Additionally, I added unit tests for LogoutListener and functional tests for both CSRF-enabled form logins and the new logout listener work. Lastly, this commit includes a cherry-pick of 60ebaaad70e6d7b8e280f34730973ee29c4c559d from the master branch.

This is not a clean merge due to a conflict with 60ebaaad70e6d7b8e280f34730973ee29c4c559d (Twig extension DI config) and 74cfd045049267d5bad7fe70131e5d95025aa393 (creation of `LogoutListener::requiresLogout()`). I attempted to eliminate one conflict by cherry-picking 60ebaaad70e6d7b8e280f34730973ee29c4c559d (a reasonable commit to back-port to the 2.0 branch), but the conflict remained.

@fabpot: If this PR is agreeable, please let me know how to proceed with preparing it for the master branch. I suppose that might entail a separate PR with an additional merge commit, but you might decide it's easier to simply do that yourself after evaluating the changes.