Repository: symfony/symfony
File: src/Symfony/Component/Security/Csrf/SameOriginCsrfTokenManager.php (PHP)

Code before:
        }

        $usageIndexValue = $session instanceof Session ? $usageIndexReference = &$session->getUsageIndex() : 0;
        $usageIndexReference = \PHP_INT_MIN;
        $session->set($this->cookieName, $request->attributes->get($this->cookieName));
        $usageIndexReference = $usageIndexValue;
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$event->isMainRequest()) {
            return;
        }

        $this->clearCookies($event->getRequest(), $event->getResponse());
        $this->persistStrategy($event->getRequest());
    }

    /**
     * @return bool|null Whether the origin is valid, null if missing
     */
    private function isValidOrigin(Request $request): ?bool
    {
        if ($request->headers->has('Sec-Fetch-Site')) {
            return 'same-origin' === $request->headers->get('Sec-Fetch-Site');
        }

        $target = $request->getSchemeAndHttpHost().'/';
        $source = 'null';

        foreach (['Origin', 'Referer'] as $header) {
            if (!$request->headers->has($header)) {
                continue;
            }
            $source = $request->headers->get($header);

            if (str_starts_with($source.'/', $target)) {
                return true;
            }
        }

        return 'null' === $source ? null : false;
    }

    /**
     * @return bool|null Whether the double-submit is valid, null if missing
     */
    private function isValidDoubleSubmit(Request $request, string $token): ?bool
    {
        if ($this->cookieName === $token) {
            return null;

Review comment (performance):
Nit: prevent an extra call to `has()` on the hot path, as most requests will have this header set.

```suggestion
        $secFetchSite = $request->headers->get('Sec-Fetch-Site');
        if ($secFetchSite !== null)) {
            return 'same-origin' === $secFetchSite;
        }
```

Code after:
        }

        $usageIndexValue = $session instanceof Session ? $usageIndexReference = &$session->getUsageIndex() : 0;
        $usageIndexReference = \PHP_INT_MIN;
        $session->set($this->cookieName, $request->attributes->get($this->cookieName));
        $usageIndexReference = $usageIndexValue;
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$event->isMainRequest()) {
            return;
        }

        $this->clearCookies($event->getRequest(), $event->getResponse());
        $this->persistStrategy($event->getRequest());
    }

    /**
     * @return bool|null Whether the origin is valid, null if missing
     */
    private function isValidOrigin(Request $request): ?bool
    {
        if (null !== $header = $request->headers->get('Sec-Fetch-Site')) {
            return 'same-origin' === $header;
        }

        $target = $request->getSchemeAndHttpHost().'/';
        $source = 'null';

        foreach (['Origin', 'Referer'] as $header) {
            if (!$request->headers->has($header)) {
                continue;
            }
            $source = $request->headers->get($header);

            if (str_starts_with($source.'/', $target)) {
                return true;
            }
        }

        return 'null' === $source ? null : false;
    }

    /**
     * @return bool|null Whether the double-submit is valid, null if missing
     */
    private function isValidDoubleSubmit(Request $request, string $token): ?bool
    {
        if ($this->cookieName === $token) {
            return null;