Issue #3115308 by andypost, ankithashetty, paulocs, longwave: Remove...

   */

  public function applies(Route $route) {

    $requirements = $route->getRequirements();

    // Check for current requirement _csrf_request_header_token and deprecated

    // REST requirement.

    $applicable_requirements = [

      '_csrf_request_header_token',

      // @todo Remove _access_rest_csrf in Drupal 10.0.0 https://www.drupal.org/node/3115308

      '_access_rest_csrf',

    ];

    if ($route->hasRequirement('_access_rest_csrf')) {

      @trigger_error('Route requirement _access_rest_csrf is deprecated in drupal:9.2.0 and is removed in drupal:10.0.0. Use _csrf_request_header_token instead. See https://www.drupal.org/node/2772399', E_USER_DEPRECATED);

    }

    $requirement_keys = array_keys($requirements);

    if (array_intersect($applicable_requirements, $requirement_keys)) {

    if (array_key_exists('_csrf_request_header_token', $requirements)) {

      if (isset($requirements['_method'])) {

        // There could be more than one method requirement separated with '|'.

        $methods = explode('|', $requirements['_method']);

  requirements:

    _csrf_request_header_token: 'TRUE'

    _method: 'POST'

# Tests deprecated _access_rest_csrf protection.

# This originally was in the REST module but now is supported in core/lib.

# @see https://www.drupal.org/node/2753681

# @todo Remove the route in drupal:10.0.0 https://www.drupal.org/node/3115308

csrf_test.deprecated.protected:

  path: csrf/deprecated/protected

  defaults:

    _controller: '\Drupal\csrf_test\Controller\TestController::testMethod'

  requirements:

    _access_rest_csrf: 'TRUE'

    _method: 'POST'

# @todo Remove this route in drupal:10.0.0 https://www.drupal.org/node/3115308

# @see \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::access()

csrf_test.deprecated.csrftoken:

  path: '/deprecated/session/token'

  defaults:

    _controller: '\Drupal\csrf_test\Controller\DeprecatedCsrfTokenController::csrfToken'

  requirements:

    _access: 'TRUE'

csrf_test.route_with_csrf_token:

  path: csrf/protected/route

  defaults:

<?php

namespace Drupal\csrf_test\Controller;

use Drupal\Core\Access\CsrfTokenGenerator;

use Drupal\Core\DependencyInjection\ContainerInjectionInterface;

use Symfony\Component\DependencyInjection\ContainerInterface;

use Symfony\Component\HttpFoundation\Response;

/**

 * Returns responses for Deprecated CSRF token routes.

 *

 * This controller tests using the deprecated CSRF token key 'rest'.

 *

 * @todo Remove this before drupal:10.0.0 https://www.drupal.org/node/3115308

 *

 * @see \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::access()

 */

class DeprecatedCsrfTokenController implements ContainerInjectionInterface {

  /**

   * The CSRF token generator.

   *

   * @var \Drupal\Core\Access\CsrfTokenGenerator

   */

  protected $tokenGenerator;

  /**

   * Constructs a new CsrfTokenController object.

   *

   * @param \Drupal\Core\Access\CsrfTokenGenerator $token_generator

   *   The CSRF token generator.

   */

  public function __construct(CsrfTokenGenerator $token_generator) {

    $this->tokenGenerator = $token_generator;

  }

  /**

   * {@inheritdoc}

   */

  public static function create(ContainerInterface $container) {

    return new static(

      $container->get('csrf_token')

    );

  }

  /**

   * Returns a CSRF using the deprecated 'rest' value protecting session token.

   *

   * @return \Symfony\Component\HttpFoundation\Response

   *   The response object.

   */

  public function csrfToken() {

    return new Response($this->tokenGenerator->get('rest'), 200, ['Content-Type' => 'text/plain']);

  }

}

  /**

   * Tests access to routes protected by CSRF request header requirements.

   *

   * This checks one route that uses _csrf_request_header_token and one that

   * uses the deprecated _access_rest_csrf.

   *

   * @group legacy

   * This checks one route that uses _csrf_request_header_token.

   */

  public function testRouteAccess() {

    $this->expectDeprecation('Route requirement _access_rest_csrf is deprecated in drupal:9.2.0 and is removed in drupal:10.0.0. Use _csrf_request_header_token instead. See https://www.drupal.org/node/2772399');

    $client = $this->getHttpClient();

    $csrf_token_paths = ['deprecated/session/token', 'session/token'];

    // Test using the both the current path and a test path that returns

    // a token using the deprecated 'rest' value.

    // Checking /deprecated/session/token can be removed in 8.3.

    // @see \Drupal\Core\Access\CsrfRequestHeaderAccessCheck::access()

    foreach ($csrf_token_paths as $csrf_token_path) {

      // Check both test routes.

      $route_names = ['csrf_test.protected', 'csrf_test.deprecated.protected'];

      foreach ($route_names as $route_name) {

    $csrf_token_path = 'session/token';

    // Test using the current path.

    $route_name = 'csrf_test.protected';

    $user = $this->drupalCreateUser();

    $this->drupalLogin($user);

    $post_options['headers']['X-CSRF-Token'] = 'this-is-not-the-token-you-are-looking-for';

    $result = $client->post($url, $post_options);

    $this->assertEquals(403, $result->getStatusCode());

      }

    }

  }

  /**

   * Tests toolbar cache integration.

   *

   * @group legacy

   */

  public function testCacheIntegration() {

    $this->expectDeprecation('Route requirement _access_rest_csrf is deprecated in drupal:9.2.0 and is removed in drupal:10.0.0. Use _csrf_request_header_token instead. See https://www.drupal.org/node/2772399');

    $this->installExtraModules(['csrf_test', 'dynamic_page_cache']);

    $this->drupalLogin($this->adminUser);

    $this->drupalGet('test-page');