Remove Config\App Security items

app/Config/App.php

@@ -158,91 +158,6 @@ class App extends BaseConfig
      */
     public array $proxyIPs = [];
 
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Token Name
-     * --------------------------------------------------------------------------
-     *
-     * The token name.
-     *
-     * @deprecated Use `Config\Security` $tokenName property instead of using this property.
-     */
-    public string $CSRFTokenName = 'csrf_test_name';
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Header Name
-     * --------------------------------------------------------------------------
-     *
-     * The header name.
-     *
-     * @deprecated Use `Config\Security` $headerName property instead of using this property.
-     */
-    public string $CSRFHeaderName = 'X-CSRF-TOKEN';
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Cookie Name
-     * --------------------------------------------------------------------------
-     *
-     * The cookie name.
-     *
-     * @deprecated Use `Config\Security` $cookieName property instead of using this property.
-     */
-    public string $CSRFCookieName = 'csrf_cookie_name';
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Expire
-     * --------------------------------------------------------------------------
-     *
-     * The number in seconds the token should expire.
-     *
-     * @deprecated Use `Config\Security` $expire property instead of using this property.
-     */
-    public int $CSRFExpire = 7200;
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Regenerate
-     * --------------------------------------------------------------------------
-     *
-     * Regenerate token on every submission?
-     *
-     * @deprecated Use `Config\Security` $regenerate property instead of using this property.
-     */
-    public bool $CSRFRegenerate = true;
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF Redirect
-     * --------------------------------------------------------------------------
-     *
-     * Redirect to previous page with error on failure?
-     *
-     * @deprecated Use `Config\Security` $redirect property instead of using this property.
-     */
-    public bool $CSRFRedirect = false;
-
-    /**
-     * --------------------------------------------------------------------------
-     * CSRF SameSite
-     * --------------------------------------------------------------------------
-     *
-     * Setting for CSRF SameSite cookie token. Allowed values are:
-     * - None
-     * - Lax
-     * - Strict
-     * - ''
-     *
-     * Defaults to `Lax` as recommended in this link:
-     *
-     * @see https://portswigger.net/web-security/csrf/samesite-cookies
-     *
-     * @deprecated `Config\Cookie` $samesite property is used.
-     */
-    public string $CSRFSameSite = 'Lax';
-
     /**
      * --------------------------------------------------------------------------
      * Content Security Policy

system/Config/Services.php

@@ -77,6 +77,7 @@
 use Config\Pager as PagerConfig;
 use Config\Paths;
 use Config\Routing;
+use Config\Security as SecurityConfig;
 use Config\Services as AppServices;
 use Config\Session as SessionConfig;
 use Config\Toolbar as ToolbarConfig;
@@ -627,13 +628,13 @@ public static function router(?RouteCollectionInterface $routes = null, ?Request
      *
      * @return Security
      */
-    public static function security(?App $config = null, bool $getShared = true)
+    public static function security(?SecurityConfig $config = null, bool $getShared = true)
     {
         if ($getShared) {
             return static::getSharedInstance('security', $config);
         }
 
-        $config ??= config(App::class);
+        $config ??= config(SecurityConfig::class);
 
         return new Security($config);
     }

system/Security/Security.php

@@ -18,7 +18,6 @@
 use CodeIgniter\I18n\Time;
 use CodeIgniter\Security\Exceptions\SecurityException;
 use CodeIgniter\Session\Session;
-use Config\App;
 use Config\Cookie as CookieConfig;
 use Config\Security as SecurityConfig;
 use Config\Services;
@@ -44,13 +43,17 @@ class Security implements SecurityInterface
      * Protection Method for Cross Site Request Forgery protection.
      *
      * @var string 'cookie' or 'session'
+     *
+     * @deprecated 4.4.0 Use $this->config->csrfProtection.
      */
     protected $csrfProtection = self::CSRF_PROTECTION_COOKIE;
 
     /**
      * CSRF Token Randomization
      *
      * @var bool
+     *
+     * @deprecated 4.4.0 Use $this->config->tokenRandomize.
      */
     protected $tokenRandomize = false;
 
@@ -69,6 +72,8 @@ class Security implements SecurityInterface
      * Token name for Cross Site Request Forgery protection.
      *
      * @var string
+     *
+     * @deprecated 4.4.0 Use $this->config->tokenName.
      */
     protected $tokenName = 'csrf_token_name';
 
@@ -78,6 +83,8 @@ class Security implements SecurityInterface
      * Header name for Cross Site Request Forgery protection.
      *
      * @var string
+     *
+     * @deprecated 4.4.0 Use $this->config->headerName.
      */
     protected $headerName = 'X-CSRF-TOKEN';
 
@@ -105,6 +112,8 @@ class Security implements SecurityInterface
      * Defaults to two hours (in seconds).
      *
      * @var int
+     *
+     * @deprecated 4.4.0 Use $this->config->expires.
      */
     protected $expires = 7200;
 
@@ -114,6 +123,8 @@ class Security implements SecurityInterface
      * Regenerate CSRF Token on every request.
      *
      * @var bool
+     *
+     * @deprecated 4.4.0 Use $this->config->regenerate.
      */
     protected $regenerate = true;
 
@@ -123,6 +134,8 @@ class Security implements SecurityInterface
      * Redirect to previous page with error on failure.
      *
      * @var bool
+     *
+     * @deprecated 4.4.0 Use $this->config->redirect.
      */
     protected $redirect = false;
 
@@ -163,35 +176,22 @@ class Security implements SecurityInterface
      */
     private ?string $hashInCookie = null;
 
+    /**
+     * Security Config
+     */
+    protected SecurityConfig $config;
+
     /**
      * Constructor.
      *
      * Stores our configuration and fires off the init() method to setup
      * initial state.
      */
-    public function __construct(App $config)
+    public function __construct(SecurityConfig $config)
     {
-        $security = config(SecurityConfig::class);
-
-        // Store CSRF-related configurations
-        if ($security instanceof SecurityConfig) {
-            $this->csrfProtection = $security->csrfProtection ?? $this->csrfProtection;
-            $this->tokenName      = $security->tokenName ?? $this->tokenName;
-            $this->headerName     = $security->headerName ?? $this->headerName;
-            $this->regenerate     = $security->regenerate ?? $this->regenerate;
-            $this->redirect       = $security->redirect ?? $this->redirect;
-            $this->rawCookieName  = $security->cookieName ?? $this->rawCookieName;
-            $this->expires        = $security->expires ?? $this->expires;
-            $this->tokenRandomize = $security->tokenRandomize ?? $this->tokenRandomize;
-        } else {
-            // `Config/Security.php` is absence
-            $this->tokenName     = $config->CSRFTokenName ?? $this->tokenName;
-            $this->headerName    = $config->CSRFHeaderName ?? $this->headerName;
-            $this->regenerate    = $config->CSRFRegenerate ?? $this->regenerate;
-            $this->rawCookieName = $config->CSRFCookieName ?? $this->rawCookieName;
-            $this->expires       = $config->CSRFExpire ?? $this->expires;
-            $this->redirect      = $config->CSRFRedirect ?? $this->redirect;
-        }
+        $this->config = $config;
+
+        $this->rawCookieName = $config->cookieName;
 
         if ($this->isCSRFCookie()) {
             $cookie = config(CookieConfig::class);
@@ -213,7 +213,7 @@ public function __construct(App $config)
 
     private function isCSRFCookie(): bool
     {
-        return $this->csrfProtection === self::CSRF_PROTECTION_COOKIE;
+        return $this->config->csrfProtection === self::CSRF_PROTECTION_COOKIE;
     }
 
     private function configureSession(): void
@@ -287,7 +287,7 @@ public function verify(RequestInterface $request)
         $postedToken = $this->getPostedToken($request);
 
         try {
-            $token = ($postedToken !== null && $this->tokenRandomize)
+            $token = ($postedToken !== null && $this->config->tokenRandomize)
                 ? $this->derandomize($postedToken) : $postedToken;
         } catch (InvalidArgumentException $e) {
             $token = null;
@@ -300,7 +300,7 @@ public function verify(RequestInterface $request)
 
         $this->removeTokenInRequest($request);
 
-        if ($this->regenerate) {
+        if ($this->config->regenerate) {
             $this->generateHash();
         }
 
@@ -318,13 +318,13 @@ private function removeTokenInRequest(RequestInterface $request): void
 
         $json = json_decode($request->getBody() ?? '');
 
-        if (isset($_POST[$this->tokenName])) {
+        if (isset($_POST[$this->config->tokenName])) {
             // We kill this since we're done and we don't want to pollute the POST array.
-            unset($_POST[$this->tokenName]);
+            unset($_POST[$this->config->tokenName]);
             $request->setGlobal('post', $_POST);
-        } elseif (isset($json->{$this->tokenName})) {
+        } elseif (isset($json->{$this->config->tokenName})) {
             // We kill this since we're done and we don't want to pollute the JSON data.
-            unset($json->{$this->tokenName});
+            unset($json->{$this->config->tokenName});
             $request->setBody(json_encode($json));
         }
     }
@@ -335,19 +335,19 @@ private function getPostedToken(RequestInterface $request): ?string
 
         // Does the token exist in POST, HEADER or optionally php:://input - json data.
 
-        if ($tokenValue = $request->getPost($this->tokenName)) {
+        if ($tokenValue = $request->getPost($this->config->tokenName)) {
             return $tokenValue;
         }
 
-        if ($request->hasHeader($this->headerName) && ! empty($request->header($this->headerName)->getValue())) {
-            return $request->header($this->headerName)->getValue();
+        if ($request->hasHeader($this->config->headerName) && ! empty($request->header($this->config->headerName)->getValue())) {
+            return $request->header($this->config->headerName)->getValue();
         }
 
         $body = (string) $request->getBody();
         $json = json_decode($body);
 
         if ($body !== '' && ! empty($json) && json_last_error() === JSON_ERROR_NONE) {
-            return $json->{$this->tokenName} ?? null;
+            return $json->{$this->config->tokenName} ?? null;
         }
 
         return null;
@@ -358,7 +358,7 @@ private function getPostedToken(RequestInterface $request): ?string
      */
     public function getHash(): ?string
     {
-        return $this->tokenRandomize ? $this->randomize($this->hash) : $this->hash;
+        return $this->config->tokenRandomize ? $this->randomize($this->hash) : $this->hash;
     }
 
     /**
@@ -407,23 +407,23 @@ protected function derandomize(string $token): string
      */
     public function getTokenName(): string
     {
-        return $this->tokenName;
+        return $this->config->tokenName;
     }
 
     /**
      * Returns the CSRF Header Name.
      */
     public function getHeaderName(): string
     {
-        return $this->headerName;
+        return $this->config->headerName;
     }
 
     /**
      * Returns the CSRF Cookie Name.
      */
     public function getCookieName(): string
     {
-        return $this->cookieName;
+        return $this->config->cookieName;
     }
 
     /**
@@ -443,7 +443,7 @@ public function isExpired(): bool
      */
     public function shouldRedirect(): bool
     {
-        return $this->redirect;
+        return $this->config->redirect;
     }
 
     /**
@@ -521,9 +521,9 @@ private function restoreHash(): void
             if ($this->isHashInCookie()) {
                 $this->hash = $this->hashInCookie;
             }
-        } elseif ($this->session->has($this->tokenName)) {
+        } elseif ($this->session->has($this->config->tokenName)) {
             // Session based CSRF protection
-            $this->hash = $this->session->get($this->tokenName);
+            $this->hash = $this->session->get($this->config->tokenName);
         }
     }
 
@@ -562,7 +562,7 @@ private function saveHashInCookie(): void
             $this->rawCookieName,
             $this->hash,
             [
-                'expires' => $this->expires === 0 ? 0 : Time::now()->getTimestamp() + $this->expires,
+                'expires' => $this->config->expires === 0 ? 0 : Time::now()->getTimestamp() + $this->config->expires,
             ]
         );
 
@@ -606,6 +606,6 @@ protected function doSendCookie(): void
 
     private function saveHashInSession(): void
     {
-        $this->session->set($this->tokenName, $this->hash);
+        $this->session->set($this->config->tokenName, $this->hash);
     }
 }

system/Test/Mock/MockAppConfig.php

@@ -18,14 +18,6 @@ class MockAppConfig extends App
     public string $baseURL         = 'http://example.com/';
     public string $uriProtocol     = 'REQUEST_URI';
     public array $proxyIPs         = [];
-    public string $CSRFTokenName   = 'csrf_test_name';
-    public string $CSRFHeaderName  = 'X-CSRF-TOKEN';
-    public string $CSRFCookieName  = 'csrf_cookie_name';
-    public int $CSRFExpire         = 7200;
-    public bool $CSRFRegenerate    = true;
-    public array $CSRFExcludeURIs  = ['http://example.com'];
-    public bool $CSRFRedirect      = false;
-    public string $CSRFSameSite    = 'Lax';
     public bool $CSPEnabled        = false;
     public string $defaultLocale   = 'en';
     public bool $negotiateLocale   = false;