By default, the new CSRF system is stateless since 7.2. That’s not a bug @cavias

By default, the new CSRF system is stateless since 7.2. That’s not a bug @cavias

@Crovitche-1623 the word stateless is not mentioned in neither Security login nor CSRF documentation, so I am failing to understand why this is relevant or what implications it has for this usecase?

See https://symfony.com/doc/current/security.html#form-login
And https://symfony.com/doc/current/security/csrf.html

@cavias You are right the documentation is not updated yet (see symfony/symfony-docs#20306) but it's already enabled (see https://symfony.com/blog/new-in-symfony-7-2-stateless-csrf). See in this section, the authenticate value is set by default

As you probably installed Symfony 7.2, you also got the following recipe : symfony/recipes#1337

@cavias I tried to reproduce it on a fresh 7.2 simple project with a protected page and login form and the login worked with the stateless csrf with string "csrf-token"

@Crovitche-1623 Thank you, that at least gives me some pointers as to what is going on. Disabling stateless_token_ids seems to "fix" it for now, but of course I'd like to get this working in the future. I see there is also a Stimulus csrf controller provided which I assume is relevant somehow.

Once documentation is released on how to actually use this I will re-enable it. The app won't be live for a few months anyways, and I am getting a bit tired of all the github deep-diving I have to do to get things working.

I will close this issue.

The behavior you describe is correct and expected. The stateless CSRF protection that you enabled by adopting the recipe update leads to these not-random tokens.
Then, you write: "Making my login not work.", and this doesn't gives us any hint about what doesn't work.

The behavior you describe is correct and expected. The stateless CSRF protection that you enabled by adopting the recipe update leads to these not-random tokens. Then, you write: "Making my login not work.", and this doesn't gives us any hint about what doesn't work.

All I'm getting when trying to login is the error message "CSRF token invalid". I should have specified that, my apologies.

I'm assuming the Stimulus csrf controller is supposed to do something here, but which data attributes with which data it needs, I do not know.

You probably need to set a data-controller="csrf-protection" to your csrf input and replace the {{ csrf_token('authenticate') }} by csrf-token (with the stateless id configuration). That's what I did to make it work !

Oh, this might be something to add to the doc, right? PR welcome!

@nicolas-grekas also to the make:security:form-login command no ?

The issue described above has been fixed in version 7.2.1.
In version 7.2.0, the update process automatically generated a CSRF configuration file (‎config/packages/csrf.yaml). As of version 7.2.1, this file is no longer generated.

This is my assumption.

It seems to me that with stateless enabled and without the csrf-protection controller we'll be left without a token based CSRF check completely?

data-controller="csrf-protection" is required indeed if you enabled the JS snippet (which you did if you accepted the recipe update)

See symfony/recipes#1373 and linked issues

Hello! I was directed here from discussion #59382 I created. I still cannot fix it for my setup (dev environment, debug on, Windows, no Docker). Stimulus bundle is here, but for some reason make:assets-install public does nothing, there is no assets directory inside public (I don't know if that is normal or not). This in login.twig.html still gives invalid CSRF token:

        <input type="hidden" name="_csrf_token"
        data-controller="csrf-protection"
        value="csrf_token"
        >

Any ideas appreciated. // CC @nicolas-grekas

If you cannot make it work, remove the csrf.yaml file brought by the recipe to revert back to previous behavior.

I'm just seeing 'csrf-token' in the value field. No Javascript, no cookies, no headers being sent. Request comes through "OK".

I had to delete the config;

# Enable stateless CSRF protection for forms and logins/logouts
framework:
    form:
        csrf_protection:
            token_id: submit

    csrf_protection:
        stateless_token_ids:
            - submit
            - authenticate
            - logout

to make CSRF actually work (so there are now random values in the field, making it stateful again).

With this setup (as described by this blog post), it seems to work, but all request work, making this seemingly CSRF protection, useless.

@RobQuistNL You don't see any value because that's the point of the CSRF stateless check ! It's done using cookies and not a form value.

@Crovitche-1623 What cookie would that be? I see no cookies being sent in the request.

I see these 2;

main_deauth_profile_token=197ddd; PHPSESSID=3c2be52776f1dfb0972e43f21446ade9

If I edit both and submit the form, it succeeds and no CSRF error is reported.

@RobQuistNL Add the mandatory data-controller on your CSRF input then. See:

symfony/symfony-docs#20530

@Crovitche-1623 that wasn't there indeed. I've added it, but its still simply accepting the request.

FYI: there is 0 javascript in the webpage. Should the be more stuff added? I'd think it would be a local piece of javascript code. But how does that work for people that have JS disabled?

Please note that all the paged so far have been generated using php bin/console make:controller Login and others, straight from the documentation.

I don't know exactly when the input field was added to the twig template, but it didn't add the data-controller="csrf-protection" as the docs here state; https://symfony.com/doc/current/security.html#form_login-csrf

Also the registration form as generated by;

composer require symfonycasts/verify-email-bundle
php bin/console make:registration-form

just shows this;

    <form name="registration_form" method="post">
        <div>(... just the form elements ...)</div>

        <button type="submit" class="btn">Sign up</button>
    <input type="hidden" id="registration_form__token" name="registration_form[_token]" data-controller="csrf-protection" value="csrf-token" /></form>

and it doesn't matter if I remove / edit cookies and submit. It just succeeds.

If I however change the value csrf-token to something else, I get this error; The CSRF token is invalid. Please try to resubmit the form.

If I however change the value csrf-token to something else, I get this error; The CSRF token is invalid. Please try to resubmit the form.

Symfony now enables Turbo UX by default, you will need to activate the AssetMapper