-
|
Folks, I'm developing a Symfony 7.2 app and I'm having a stupid error. I definitely missed something but I don't know what. <input type="hidden" name="_csrf_token"
value="csrf-token"
>So, the value of the token is, well, <input type="hidden" name="_csrf_token"
value="{{ csrf_token('authenticate') }}"
>Here is the firewall: firewalls:
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
lazy: true
provider: app_user_provider
form_login:
login_path: app_login
check_path: app_login
enable_csrf: true
logout:
path: app_logout
target: /It's a Windows machine, environment is |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 5 replies
-
|
7.2 recipes configure some stateless CSRF token IDs like The StimulusBundle’s recipe has been updated as well to generate the token client-side, but if you’re not using it you have two options:
|
Beta Was this translation helpful? Give feedback.
-
|
Sorry @MatTheCat, but I still don't understand. I have no such things in the configuration, so should I add it manually? In my framework:
secret: '%env(APP_SECRET)%'
session: true
#esi: true
#fragments: true
when@test:
framework:
test: true
session:
storage_factory_id: session.storage.factory.mock_fileSo nothing related to CSRF in the Framework node. Should I re-add it or?.. It's a clear new 7.2 installation, so I'm confused. |
Beta Was this translation helpful? Give feedback.
-
|
The corresponding config got moved in |
Beta Was this translation helpful? Give feedback.
-
|
Yepp, framework:
form:
csrf_protection:
token_id: submit
csrf_protection:
stateless_token_ids:
- submit
- authenticate
- logoutSo what am I missing here? Here's the login template: {% extends 'base.html.twig' %}
{% block title %}Please Sign In{% endblock %}
{% block content %}
<form method="post">
{% if error %}
<div class="alert alert-danger">{{ error.messageKey|trans(error.messageData, 'security') }}</div>
{% endif %}
{% if app.user %}
<div class="mb-3" role="contentinfo">
You are logged in as {{ app.user.displayName}}, <a href="{{ path('app_logout') }}">Logout</a>
</div>
{% endif %}
<h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
<label for="username">Username</label>
<input type="text" value="{{ last_username }}" name="_username" id="username" class="form-control" autocomplete="username" required autofocus>
<label for="password">Password</label>
<input type="password" name="_password" id="password" class="form-control" autocomplete="current-password" required>
<input type="hidden" name="_csrf_token"
value="{{ csrf_token('authenticate') }}"
>
<button class="btn btn-default" type="submit">
Sign in
</button>
</form>
{% endblock %} |
Beta Was this translation helpful? Give feedback.
-
|
The new So you have two choices: either you implement this client-side part (with the StimulusBundle or yourself), or you remove the (Please use “Write a reply” instead of “Suggest an answer” when you are replying: that makes conversation more easy to follow!) |
Beta Was this translation helpful? Give feedback.
-
|
Oh, sorry for hijacking the discussion and writing comments in the wrong place, my bad. |
Beta Was this translation helpful? Give feedback.
-
No problem, it’s just good to know when many people are involved ^^
You’re half-right: this attribute must be added on the CSRF token field! If Stimulus is working then that should be all indeed.
I understand how you feel and you’re not the only one (see #59111 e.g.). An issue is still open for documenting this feature: symfony/symfony-docs#20306 you may want to contribute. |
Beta Was this translation helpful? Give feedback.
-
|
Still cannot fix it, commented in #59111 . Now I have: <input type="hidden" name="_csrf_token"
data-controller="csrf-protection"
value="csrf_token"
>Stimulus bundle is there, but for some reason no assets are put into the |
Beta Was this translation helpful? Give feedback.
-
|
Thank you @MatTheCat, solution found.
<input type="hidden" name="_csrf_token"
data-controller="csrf-protection"
value="csrf_token"
>
|
Beta Was this translation helpful? Give feedback.
Thank you @MatTheCat, solution found.
Here are the steps:
./bin/console cache:clear.