Stateless CSRF protection outside Symfony Forms #59851
Replies: 1 comment
-
Just use the same I wrote an article explaining how stateless & stateful CSRF protection works in-depth in Symfony because I wanted to know myself. If you're confused, this should help. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
I don't use Turbo to handle form submissions. I use Axios or Fetch.
After some testing the protection works fine when handling Symfony Forms submissions with Axios. But what if I want to use stateless protection when no Symfony form is submitted?
I am aware of https://symfony.com/doc/current/security/csrf.html#generating-and-checking-csrf-tokens-manually but this describes only stateful CSRF, am I right?
I would like to leverage stateless protection without Symfony form. On client side I could use the code from csrf_protection_controller.js, but how do I check the validity on the server side?
Beta Was this translation helpful? Give feedback.
All reactions