Add CSRF protection to logout url in the user controller

Author: rosier

config/services.yaml

@@ -34,6 +34,8 @@ services:
     App\EventSubscriber\CommentNotificationSubscriber:
         $sender: '%app.notifications.email_sender%'
 
+    Symfony\Component\Security\Http\Logout\LogoutUrlGenerator: '@security.logout_url_generator'
+
 when@test:
     services:
         test.user_password_hasher:

src/Controller/UserController.php

@@ -20,6 +20,7 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Security\Http\Logout\LogoutUrlGenerator;
 
 /**
  * Controller used to manage current user.
@@ -52,7 +53,7 @@ public function edit(Request $request, EntityManagerInterface $entityManager): R
     }
 
     #[Route('/change-password', methods: ['GET', 'POST'], name: 'user_change_password')]
-    public function changePassword(Request $request, UserPasswordHasherInterface $passwordHasher, EntityManagerInterface $entityManager): Response
+    public function changePassword(Request $request, UserPasswordHasherInterface $passwordHasher, EntityManagerInterface $entityManager, LogoutUrlGenerator $logoutUrlGenerator): Response
     {
         $user = $this->getUser();
 
@@ -63,7 +64,7 @@ public function changePassword(Request $request, UserPasswordHasherInterface $pa
             $user->setPassword($passwordHasher->hashPassword($user, $form->get('newPassword')->getData()));
             $entityManager->flush();
 
-            return $this->redirectToRoute('security_logout');
+            return $this->redirect($logoutUrlGenerator->getLogoutPath());
         }
 
         return $this->render('user/change_password.html.twig', [

tests/Controller/UserControllerTest.php

@@ -90,9 +90,10 @@ public function testChangePassword(): void
             'change_password[newPassword][second]' => $newUserPassword,
         ]);
 
-        $this->assertResponseRedirects(
+        $this->assertResponseRedirects();
+        $this->assertStringStartsWith(
             '/en/logout',
-            Response::HTTP_FOUND,
+            $client->getResponse()->headers->get('Location') ?? '',
             'Changing password logout the user.'
         );
     }