Merge pull request #1337 from symfony/csrf-double-submit

Enable stateless headers/cookies-based CSRF protection
2026-09-12 07:36:30 +03:00 · 2024-11-17 10:14:14 +01:00
parent 6c43cb8f59 21a9094ea7
commit f614c444f9
7 changed files with 142 additions and 0 deletions
@@ -8,6 +8,11 @@ framework:
    #esi: true
    #fragments: true

+    # Enable stateless CSRF protection for forms and logins/logouts
+    form: { csrf_protection: { token_id: submit } }
+    csrf_protection:
+        stateless_token_ids: [submit, authenticate, logout]
+
 when@test:
    framework:
        test: true