CsrfRequestHeaderAccessCheck::applies

public CsrfRequestHeaderAccessCheck::applies(Route $route)

public function applies(Route $route) {
  $requirements = $route->getRequirements();
  // Check for current requirement _csrf_request_header_token and deprecated
  // REST requirement.
  $applicable_requirements = [
    '_csrf_request_header_token',
    // @todo Remove _access_rest_csrf in Drupal 9.0.0.
    '_access_rest_csrf',
  ];
  $requirement_keys = array_keys($requirements);

  if (array_intersect($applicable_requirements, $requirement_keys)) {
    if (isset($requirements['_method'])) {
      // There could be more than one method requirement separated with '|'.
      $methods = explode('|', $requirements['_method']);
      // CSRF protection only applies to write operations, so we can filter
      // out any routes that require reading methods only.
      $write_methods = array_diff($methods, array('GET', 'HEAD', 'OPTIONS', 'TRACE'));
      if (empty($write_methods)) {
        return FALSE;
      }
    }
    // No method requirement given, so we run this access check to be on the
    // safe side.
    return TRUE;
  }
}