[Security] Added check_post_only to the login link authenticator

Author: wouterj

Authenticator/LoginLinkAuthenticator.php

@@ -43,18 +43,18 @@ public function __construct(LoginLinkHandlerInterface $loginLinkHandler, HttpUti
         $this->httpUtils = $httpUtils;
         $this->successHandler = $successHandler;
         $this->failureHandler = $failureHandler;
-        $this->options = $options;
+        $this->options = $options + ['check_post_only' => false];
     }
 
     public function supports(Request $request): ?bool
     {
-        return $this->httpUtils->checkRequestPath($request, $this->options['check_route']);
+        return ($this->options['check_post_only'] ? $request->isMethod('POST') : true)
+            && $this->httpUtils->checkRequestPath($request, $this->options['check_route']);
     }
 
     public function authenticate(Request $request): PassportInterface
     {
         $username = $request->get('user');
-
         if (!$username) {
             throw new InvalidLoginLinkAuthenticationException('Missing user from link.');
         }

Tests/Authenticator/LoginLinkAuthenticatorTest.php

@@ -39,6 +39,24 @@ protected function setUp(): void
         $this->failureHandler = $this->createMock(AuthenticationFailureHandlerInterface::class);
     }
 
+    /**
+     * @dataProvider provideSupportData
+     */
+    public function testSupport(array $options, $request, bool $supported)
+    {
+        $this->setUpAuthenticator($options);
+
+        $this->assertEquals($supported, $this->authenticator->supports($request));
+    }
+
+    public function provideSupportData()
+    {
+        yield [['check_route' => '/validate_link'], Request::create('/validate_link?hash=abc123'), true];
+        yield [['check_route' => '/validate_link'], Request::create('/login?hash=abc123'), false];
+        yield [['check_route' => '/validate_link', 'check_post_only' => true], Request::create('/validate_link?hash=abc123'), false];
+        yield [['check_route' => '/validate_link', 'check_post_only' => true], Request::create('/validate_link?hash=abc123', 'POST'), true];
+    }
+
     public function testSuccessfulAuthenticate()
     {
         $this->setUpAuthenticator();