Symfony 2 Ajax提交，令牌CSRF无效

我选择的解决方案是在每个LoginAjax操作中重新生成令牌，并在响应中发送它（以JSON格式格式化）。然后我只需要更新所有具有令牌字段的表单（可以通过为每个令牌设置一个特定的类来使用）

实现AuthenticationSuccessHandler的第一步定义为该

acme.security.ajax_handler:
    class: Acme'UserBundle'Listener'AjaxAuthenticationListener
    arguments: ["@form.csrf_provider", "@router"]

类AjaxAuthenticationListener

    <?php
namespace Travelyo'UserBundle'Listener;
use Symfony'Component'HttpFoundation'Response;
use Symfony'Component'HttpFoundation'RedirectResponse;
use Symfony'Component'Security'Core'Authentication'Token'TokenInterface;
use Symfony'Component'Security'Core'Exception'AuthenticationException;
use Symfony'Component'HttpFoundation'Request;
use Symfony'Component'Security'Http'Authentication'AuthenticationFailureHandlerInterface;
use Symfony'Component'Security'Http'Authentication'AuthenticationSuccessHandlerInterface;
/**
 * Refere to http://stackoverflow.com/questions/8607212/symfony2-ajax-login
 * @author yoni
 *
 */
class AjaxAuthenticationListener implements AuthenticationSuccessHandlerInterface, AuthenticationFailureHandlerInterface {
    protected $csrf_provider;
    protected $router;
    /**
     * In case we have Failure I need to provide a new csrf token
     * @param unknown_type $csrf_provider
     * @author Yoni Alhadeff
     */
    public function __construct($csrf_provider, $router)
    {
        $this->csrf_provider = $csrf_provider;
        $this->router = $router;
    }
    /**
     * This is called when an interactive authentication attempt succeeds. This
     * is called by authentication listeners inheriting from
     * AbstractAuthenticationListener.
     *
     * @see SymfonyComponentSecurityHttpFirewallAbstractAuthenticationListener
     * @param Request        $request
     * @param TokenInterface $token
     * @return Response the response to return
     */
    public function onAuthenticationSuccess(Request $request, TokenInterface $token)
    {
        if ($request->isXmlHttpRequest())
        {
            $result = array('success' => true, 'token'=>$this->csrf_provider->generateCsrfToken('unknown'));
            $response = new Response(json_encode($result));
            $response->headers->set('Content-Type', 'application/json');
            return $response;
        } else
        {
            // If the user tried to access a protected resource and was forces to login
            // redirect him back to that resource
            if ($targetPath = $request->getSession()->get('_security.account.target_path'))
            {
                $url = $targetPath;
            } else
            {
                // Otherwise, redirect him to wherever you want
                $url = $this->router->generate('homepage_route_name', array());
            }
            return new RedirectResponse($url);
        }
    }
    /**
     * This is called when an interactive authentication attempt fails. This is
     * called by authentication listeners inheriting from
     * AbstractAuthenticationListener.
     *
     * @param Request                 $request
     * @param AuthenticationException $exception
     * @return Response the response to return
     */
    public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
    {
        if ($request->isXmlHttpRequest())
        {
            $result = array('success' => false, 'error'=>$exception->getMessage(),'token'=>$this->csrf_provider->generateCsrfToken('authenticate'));
            $response = new Response(json_encode($result));
            $response->headers->set('Content-Type', 'application/json');
            return $response;
        } else
        {
            // Create a flash message with the authentication error message
            $request->getSession()->setFlash('error', $exception->getMessage());
            $url = $this->router->generate('fos_frontend_security_login');
            return new RedirectResponse($url);
        }
    }
}

两者都在Failure&使用AJAX成功登录时，我在响应中添加了新的令牌。

在javascript中ward之后，在AJAX调用的Succes:function（）中，我只需要更新字段

诸如此类的事情。

var route = $('#loginUrl').val();
var data= '_username=' +       $("#username").val()+"&_password="+$('#password').val()+"&_csrf_token="+$('#csrf_token').val();
$.ajax( {
    type : "POST",
    url : route,
    data: data,
    dataType: 'json',
    cache : false,
    success : function(response, value){
        //Response.success came from the JSON defined in the AjaxAuthenticationListener, he's not linked to the AJAX call
        if(response.success==true)
        {
        }
        $('#csrf_token').val(response.token); //Token has to be regenerate
        $(".tokenField").val(response.token);
    }
});

我认为这是一个更容易的解决方案。

CSRF令牌部分使用cookie。当您在一个页面上生成两个CSRF并提交其中一个表单时，您将使cookie无效。

如果没有对框架本身进行一些扩展，我只能真正看到解决这一问题的一种方法——而且它相当迂回：

你可以做的是设置一个控制器来生成你的应用程序表单

在初始页面加载时，您的控制器将加载登录表单和应用程序表单。通过AJAX提交登录表单后，您还将只请求控制器的应用程序表单（这也将为用户提供一个新的cookie）。使用javascript，您可以从新表单中提取新的csrf令牌，并将其注入原始应用程序表单。然后，当您提交应用程序表单时，它应该有一个新的有效csrf令牌。

举例说明：

获取应用表单和登录表单->通过AJAX提交登录->在后台通过AJAX获取应用表单->窃取新应用表单的csrf令牌并将其注入第一个应用表单->提交应用表单。

使用$('form').serialize():

$('#form_login').submit(function(){
    $.ajax({
        url:    $(this).attr('action'),
        method: $(this).attr('method'),
        data:   $(this).serialize(),
        success: function(response){
            alert(response);
        }
    });
});

在控制器中使用以下内容：

• return new Response('ok')的良好响应和
• 响应不良的return new Response('bad :(', 500)