class AjaxBasePageNegotiator

class AjaxBasePageNegotiator implements ThemeNegotiatorInterface {
    
    /**
     * The CSRF token generator.
     *
     * @var \Drupal\Core\Access\CsrfTokenGenerator
     */
    protected $csrfGenerator;
    
    /**
     * The config factory.
     *
     * @var \Drupal\Core\Config\ConfigFactoryInterface
     */
    protected $configFactory;
    
    /**
     * The request stack.
     *
     * @var \Symfony\Component\HttpFoundation\RequestStack
     */
    protected $requestStack;
    
    /**
     * Constructs a new AjaxBasePageNegotiator.
     *
     * @param \Drupal\Core\Access\CsrfTokenGenerator $token_generator
     *   The CSRF token generator.
     * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
     *   The config factory.
     * @param \Symfony\Component\HttpFoundation\RequestStack $request_stack
     *   The request stack used to retrieve the current request.
     */
    public function __construct(CsrfTokenGenerator $token_generator, ConfigFactoryInterface $config_factory, RequestStack $request_stack) {
        $this->csrfGenerator = $token_generator;
        $this->configFactory = $config_factory;
        $this->requestStack = $request_stack;
    }
    
    /**
     * {@inheritdoc}
     */
    public function applies(RouteMatchInterface $route_match) {
        $ajax_page_state = $this->requestStack
            ->getCurrentRequest()->request
            ->get('ajax_page_state');
        return !empty($ajax_page_state['theme']) && isset($ajax_page_state['theme_token']);
    }
    
    /**
     * {@inheritdoc}
     */
    public function determineActiveTheme(RouteMatchInterface $route_match) {
        $ajax_page_state = $this->requestStack
            ->getCurrentRequest()->request
            ->get('ajax_page_state');
        $theme = $ajax_page_state['theme'];
        $token = $ajax_page_state['theme_token'];
        // Prevent a request forgery from giving a person access to a theme they
        // shouldn't be otherwise allowed to see. However, since everyone is
        // allowed to see the default theme, token validation isn't required for
        // that, and bypassing it allows most use-cases to work even when accessed
        // from the page cache.
        if ($theme === $this->configFactory
            ->get('system.theme')
            ->get('default') || $this->csrfGenerator
            ->validate($token, $theme)) {
            return $theme;
        }
    }

}