Repository: symfony/symfony
File: src/Symfony/Component/Security/Csrf/SameOriginCsrfTokenManager.php (PHP)

Code before:
            }
        }

        if ($isValidOrigin && $isValidDoubleSubmit) {
            $csrfProtection = 3;
            $this->logger?->debug('CSRF validation accepted using both origin and double-submit info.');
        } elseif ($isValidOrigin) {
            $csrfProtection = 1;
            $this->logger?->debug('CSRF validation accepted using origin info.');
        } else {
            $csrfProtection = 2;
            $this->logger?->debug('CSRF validation accepted using double-submit info.');
        }

        if (1 & $csrfProtection) {
            // Persist valid origin for both safe and non-safe requests
            $previousCsrfProtection |= 1 | (1 << 8);
        }

        $request->attributes->set($this->cookieName, ($csrfProtection << $shift) | $previousCsrfProtection);

        return true;
    }

    public function clearCookies(Request $request, Response $response): void
    {
        if (!$request->attributes->has($this->cookieName)) {
            return;
        }

        $cookieName = ($request->isSecure() ? '__Host-' : '').$this->cookieName;

        foreach ($request->cookies->all() as $name => $value) {
            if ($this->cookieName === $value && str_starts_with($name, $cookieName.'_')) {
                $response->headers->clearCookie($name, '/', null, $request->isSecure(), false, 'strict');
            }
        }
    }

    public function persistStrategy(Request $request): void
    {
        if (!$request->attributes->has($this->cookieName)
            || !$request->hasSession(true)
            || !($session = $request->getSession())->isStarted()
        ) {
            return;
        }

        $usageIndexValue = $session instanceof Session ? $usageIndexReference = &$session->getUsageIndex() : 0;
        $usageIndexReference = \PHP_INT_MIN;
        $session->set($this->cookieName, $request->attributes->get($this->cookieName));

Review comment (security):
```suggestion
     * @deprecated since Symfony 8.1 and will be removed in 9.0. The logic is handled by SameOriginCsrfListener.
```

Code after:
            }
        }

        if ($isValidOrigin && $isValidDoubleSubmit) {
            $csrfProtection = 3;
            $this->logger?->debug('CSRF validation accepted using both origin and double-submit info.');
        } elseif ($isValidOrigin) {
            $csrfProtection = 1;
            $this->logger?->debug('CSRF validation accepted using origin info.');
        } else {
            $csrfProtection = 2;
            $this->logger?->debug('CSRF validation accepted using double-submit info.');
        }

        if (1 & $csrfProtection) {
            // Persist valid origin for both safe and non-safe requests
            $previousCsrfProtection |= 1 | (1 << 8);
        }

        $request->attributes->set($this->cookieName, ($csrfProtection << $shift) | $previousCsrfProtection);

        return true;
    }

    /**
     * @deprecated since Symfony 8.1, logic is handled by SameOriginCsrfListener.
     */
    public function clearCookies(Request $request, Response $response): void
    {
        trigger_deprecation('symfony/security-csrf', '8.1', 'The "%s()" method is deprecated and will be removed in 9.0, use "%s::clearCookies()" instead.', __METHOD__, SameOriginCsrfListener::class);

        if (!$request->attributes->has($this->cookieName)) {
            return;
        }

        $cookieName = ($request->isSecure() ? '__Host-' : '').$this->cookieName;

        foreach ($request->cookies->all() as $name => $value) {
            if ($this->cookieName === $value && str_starts_with($name, $cookieName.'_')) {
                $response->headers->clearCookie($name, '/', null, $request->isSecure(), false, 'strict');
            }
        }
    }

    /**
     * @deprecated since Symfony 8.1, logic is handled by SameOriginCsrfListener.
     */
    public function persistStrategy(Request $request): void
    {
        trigger_deprecation('symfony/security-csrf', '8.1', 'The "%s()" method is deprecated and will be removed in 9.0, use "%s::persistStrategy()" instead.', __METHOD__, SameOriginCsrfListener::class);