Skip to content

Changed getTokenFromRequest method to handle null value and prevent type error #1819

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: 13.x
Choose a base branch
from

Conversation

eldair
Copy link

@eldair eldair commented May 21, 2025

This code change solves Laravel\Passport\Guards\TokenGuard::getTokenFromRequest(): Return value must be of type string, null returned error which can happen when X-CSRF-TOKEN is missing from the request.

It also aligns getTokenFromRequest method with it's counterpart in VerifyCsrfToken class (which has no return value and handles null value in tokensMatch method)

@hafezdivandari
Copy link
Contributor

I think it is safer to just change the return type to ?string ?

@eldair
Copy link
Author

eldair commented May 21, 2025

@hafezdivandari hash_equals function which uses the return value of this method requires all arguments to be string

@hafezdivandari
Copy link
Contributor

@eldair yes, that's why we should change the validCsrf method instead, check if the token is not null there.

@eldair
Copy link
Author

eldair commented May 21, 2025

@hafezdivandari something like this? Partly copied from similar method (tokensMatch) in Illuminate\Foundation\Http\Middleware\VerifyCsrfToken

@hafezdivandari
Copy link
Contributor

Lgtm, thanks.

Co-authored-by: Hafez Divandari <[email protected]>
@taylorotwell taylorotwell marked this pull request as draft May 23, 2025 14:37
@taylorotwell
Copy link
Member

Tests fail.

@hafezdivandari
Copy link
Contributor

hafezdivandari commented May 23, 2025

@taylorotwell failed tests are unrelated to changes on this PR and already have been fixed via laravel/framework#55800 (not released yet).

@eldair you may mark this PR as ready again, thanks.

@eldair eldair marked this pull request as ready for review May 23, 2025 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants