Problem/Motivation

If a route requires a CSRF token and this token is not provided in the query string, the returned error message currently states:

'csrf_token' URL query argument is missing.

This is confusing because the actual query parameter name checked by Drupal is token, not csrf_token.

Proposed resolution

Update the exception message in CsrfAccessCheck to reference the correct argument name:

'token' URL query argument is missing.

Update unit test assertions in CsrfAccessCheckTest to match.

Remaining tasks

- Review MR !17821
- Maintainer review

User interface changes

Clarified error message text when CSRF token query argument is missing.

Introduced terminology

None

API changes

None

Data model changes

None

Release notes snippet

N/A

Issue fork drupal-3638184

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

keerthi kumar’s picture

keerthi kumar commented
Assigned: Unassigned » keerthi kumar

I'll be working in this

keerthi kumar opened merge request !17821

keerthi kumar’s picture

keerthi kumar commented
Status: Active » Needs review
keerthi kumar’s picture

keerthi kumar commented

Opened MR 17821 updating the error messages in CsrfAccessCheck to reference the actual query parameter 'token' instead of 'csrf_token', and updated the corresponding unit tests in CsrfAccessCheckTest.

keerthi kumar’s picture

keerthi kumar commented
Issue summary: View changes