Determine if the session and input CSRF tokens match.

@param  \Illuminate\Http\Request  $request

@return bool
502855
protected function tokensMatch($request)
    {
        $token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');

        if (! $token && $header = $request->header('X-XSRF-TOKEN')) {
            $token = $this->encrypter->decrypt($header);
        }

        return hash_equals((string) $request->session()->token(), (string) $token);
    }
1201949
public function filter($request)
    {
        // Check if user is authenticated via an auth session
        $this->session_authenticated = $this->isUserSessionAuthenticated();

        // Check if user is authenticated via an auth token
        $this->token_authenticated = $this->isUserTokenAuthenticated($request);

        // Decide if user is authenticated
        $this->user_authenticated = $this->isUserAuthenticated([$this->session_authenticated, $this->token_authenticated]);

        if ($this->user_authenticated === false)
        {
            // There is no way to know, for definite, which 'method' a user intended to authenticate, unless a token was
            // used, in which case it is safe to assume which method they were using.
            // In cases where a token wasn't given and the user has requested a JSON response, we assume they were trying
            // to use token authentication. Otherwise we assume they were trying to use session authentication.

            // Note: This approach maybe revised in the future.

            if (($this->token_authenticated !== false && $this->token_authenticated instanceof MissingTokenException === false) || Request::wantsJson())
            {
                $this->tokenAuthenticationFailure();
            }

            $this->sessionAuthenticationFailure();
            // BUG: For some reason issuing a redirect within a function other than this one doesn't do anything.
            return Redirect::guest('login');
        }
    }
657203
private function isFormRequest(Request $request)
    {
        $contentTypeParts = explode(';', $request->headers->get('Content-Type'));

        if (isset($contentTypeParts[0])) {
            return in_array($contentTypeParts[0], ['multipart/form-data', 'application/x-www-form-urlencoded']);
        }

        return false;
    }
419541
public function matchesPattern(Request $request)
    {
        if (preg_match($this->regexPattern, $request->getRequestUri()) <= 0) {
            return false;
        }

        return true;
    }
1237820
public function authorizeCSRF(array $request)
	{
		$t = $request[$this->_csrf_submittedvaluename];
		if ( is_null($t) )
			$t = '';
		
		
		// if CSRF submitted value in request begins with '!' it means it has been hashed so that the real CSRF value is not disclosed in GET, history, cache, etc.
		if ( strpos($t, '!') === 0 )
			$b = hash_equals($this->getHashedCSRFCookie(), $t);
		else
			$b = hash_equals($this->getCSRFCookie(), $t);

		
		// if CSRF cookie exists, comparing with double-submitted cookie as a request value
		if ( !$b )
			throw new SecureRequestHelper\CSRFException('CSRF security validation failed');
		
		return true;
	}
191035
public function matches($request, $queries = [])
    {
        $this->setQueries($queries);

        if (! $request && $this->isHomePath()) {
            return true;
        }

        if ($matches = preg_match("@^{$this->getPathMock($queries)}$@", $request)) {
            if ($this->rulesNotPassed()) {
                return false;
            }
        }

        return (bool) $matches;
    }
54520
public function authenticate(Request $request)
    {
        if (Auth::user()) {
            return false;
        }

        $this->checkForToken($request);

        try {
            if (!JWTAuth::parseToken()->authenticate()) {
                throw new UnauthorizedHttpException('jwt-auth', 'User not found');
            }
        } catch (TokenExpiredException $e) {
            // If the token is expired, then it will be refreshed and added to the headers
            try {
                return Auth::refresh();
            } catch (TokenExpiredException $e) {
                throw new UnauthorizedHttpException('jwt-auth', 'Refresh token has expired.');
            }
        } catch (TokenBlacklistedException $e) {
            throw new TokenBlacklistedException($e->getMessage(), 401);
        } catch (JWTException $e) {
            throw new UnauthorizedHttpException('jwt-auth', $e->getMessage(), $e, $e->getCode());
        }
    }
824241
public function tokenIsValid(Request $request, ISession $session) : bool
    {
        if (!$session->has(self::TOKEN_INPUT_NAME)) {
            $session->set(self::TOKEN_INPUT_NAME, \bin2hex(\random_bytes(16)));
        }

        if ($this->tokenShouldNotBeChecked($request)) {
            return true;
        }

        // Try an input
        $token = $request->getInput(self::TOKEN_INPUT_NAME);

        // Try the X-CSRF header
        if ($token === null) {
            $token = $request->getHeaders()->get('X-CSRF-TOKEN');
        }

        // Try the X-XSRF header
        if ($token === null) {
            $token = $request->getHeaders()->get('X-XSRF-TOKEN');
        }

        if ($token === null) {
            return false;
        }

        return \hash_equals($session->get(self::TOKEN_INPUT_NAME), $token);
    }
1363305
public function hasValidSignature(Request $request)
    {
        $url = $request->url();

        $original = rtrim($url.'?'.Arr::query(
            Arr::except($request->query(), 'signature')
        ), '?');

        $expires = $request->query()['expires'] ?? null;

        $signature = \hash_hmac('sha256', $original, \call_user_func($this->keyResolver));

        return  \hash_equals($signature, (string) $request->query('signature', '')) &&
               ! ($expires && Carbon::now()->getTimestamp() > $expires);
    }
588825
public function validateState(HTTPRequest $request)
    {
        $state = $request->getVar('state');
        $session = $request->getSession();
        $data = $session->get('oauth2');

        // If we're lacking any required data, or the session state doesn't match
        // the one the provider returned, the request is invalid
        if (empty($data['state']) || empty($data['provider']) || empty($data['scope']) || $state !== $data['state']) {
            $session->clear('oauth2');
            return false;
        }

        return true;
    }
1004674
protected function tokensMatch($request)
    {
        $sessionToken = $request->session()->token();

        $token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');

        if (is_null($token) && ! is_null($header = $request->header('X-XSRF-TOKEN'))) {
            $token = $this->encrypter->decrypt($header);
        }

        if (! is_string($sessionToken) || ! is_string($token)) {
            return false;
        }

        return Str::equals($sessionToken, $token);
    }
102832
public function checkForToken(Request $request)
    {
        if (! $this->auth->parser()->setRequest($request)->hasToken()) {
            throw new UnauthorizedHttpException('jwTauth', 'Token not provided');
        }
    }
700266
protected function validateRequest(Request $request)
    {
        if (php_sapi_name() === 'cli') {
            return false;
        }
        $route   = call_user_func($request->getRouteResolver());
        $ignored = $this->container->make('config')->get('antares/ui-components::ignore');
        $action  = $route->getAction();


        if (isset($action['uses']) and $action['uses'] instanceof Closure) {
            return true;
        }

        $resource = array_get($action, 'controller');

        foreach ($ignored as $controller => $actions) {
            foreach ($actions as $action) {
                if ($resource === "$controller@$action") {
                    return true;
                }
            }
        }

        return !( $request->method() !== 'GET' or ! empty($request->query()));
    }
5188
protected function _checkCsrf() {
        if ($this->_configFirewall['csrf']['enabled'] == true && $this->request->logged == true) {
            if ($this->_csrf['SESSION'] != false && ($this->_csrf['GET'] != false || $this->_csrf['POST'] != false)) {
                if ($this->_csrf['POST'] == $this->_csrf['SESSION'] || $this->_csrf['GET'] == $this->_csrf['SESSION']) {
                    return true;
                }
                else {
                    return false;
                }
            }
            else {
                return true;
            }
        }
        else {
            return true;
        }
    }
893860
public function has(Request $request, string $key): bool
    {
        $exists = $this->getSession($request)->has($key);

        $this->logger->info('session: has key {key}, exists {exists}', ['key' => $key, 'exists' => $exists]);

        return $exists;
    }
925590
public function forUser(Request $request)
    {
        $tokens = $this->tokenRepository->forUser($request->user()->getKey());

        return $tokens->load('client')->filter(function ($token) {
            return ! $token->client->firstParty() && ! $token->revoked;
        })->values();
    }
956214
public function handle(Request $request, string $method = self::HTTP_POST): bool
    {
        if (!$request->isMethod($method)) {
            return false;
        }

        if ($request->request->has('csrf_token')) {
            $session = new Session();

            if ($session->get('csrf_token') !== $request->request->get('csrf_token')) {
                throw new InvalidCsrfTokenException();
            }

            $request->request->remove('csrf_token');
        }

        $this->dataCollection = array_merge($request->request->all(), $request->files->all());

        return true;
    }