Invalid CSRF using symfony2 form type

Question

I'm creating 2 forms in one action and these forms are submitted by jquery ajax to other 2 actions. Now, problem is - only first form works. Edit form throws that csrf token is invalid. Why is that happening? My code:

Creating forms:

$project = new Project();
      $addProjectForm = $this->createForm(new AddProjectType(), $project, [
        'action' => $this->generateUrl('tfpt_portfolio_versionhistory_addproject'),
        'method' => 'POST',
        'attr' => ['id' => 'newProjectForm']
      ]);
      $editProjectForm = $this->createForm(new EditProjectType(), $project, [
        'action' => $this->generateUrl('tfpt_portfolio_versionhistory_editproject'),
        'method' => 'POST',
        'attr' => ['id' => 'editProjectForm']
      ]);

Handling submit edit form (but add form is pretty much identical):

$project = new Project();
      $form = $this->createForm(new EditProjectType(), $project);

      $form->handleRequest($request);
      if($form->isValid()){
        //handle form
      }
}

The only diffrence between these 2 forms is that edit form have one more field - hidden id. Both are submitted by jquery like that:

var form = $("#editProjectForm")
            if(form.valid()){
                $("#loader").show();
                $.ajax({
                    type: form.attr('method'),
                    url: form.attr('action'),
                    data: form.serialize()
                }).done(function(data){
                       //result
                            }
                        });

And i display forms like that:

 {{ form_start(editProjectForm) }}
 {{ form_errors(editProjectForm) }}
 {{ form_widget(editProjectForm.name) }}
 {{ form_widget(editProjectForm.id) }}
 {{ form_rest(editProjectForm) }}
 {{ form_end(editProjectForm) }}

Can somebody point my mistake? Isn't it possible to embed 3 forms in one action? Or i have to generate CSRF other way?

@Edit: I updated symfony to the newest release and now it's working prefect. Seems like this version had a bug or i got some lack of vendors code. Anyway, problem resolved.

Not sure I get it right. You send the 3 forms to the view at the same time? What does your controller action code look like? — cheesemacfly
– cheesemacfly, Commented Oct 23, 2013 at 15:20
Yes, i'm doing that (on 2 forms). My question is about if i can do it. And if not - what's the alternative? My Action got only one line more - return array with those forms — Jakoss
– Jakoss, Commented Oct 23, 2013 at 16:23

JGrinon · Accepted Answer · 2013-10-30 08:16:01Z

2

I think you have to create two tokens in the controller:

$token_add = $this->get('form.csrf_provider')->generateCsrfToken('add');

$token_edit = $this->get('form.csrf_provider')->generateCsrfToken('edit');

and put in the view in hidden field. And then validate in the controller action that proccess the form

# Here you can validate the 'add' or 'edit' token
if (!$this->get('form.csrf_provider')->isCsrfTokenValid('add', $token)) {

    $respuesta = array('mensaje' => 'Oops! Invalid token.',
                       'token' => $token);
    return new Response(json_encode($respuesta));
}

answered Oct 30, 2013 at 8:16

JGrinon

1,4531 gold badge14 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Jakoss Over a year ago

Any chances i can validate that token by $form->isValid() ?

JGrinon Over a year ago

i think yes! Please try it and if you have any issue tell us!

Jakoss Over a year ago

Doesn't really matter, seems like my problem was caused by Symfony2 code (explanation in edited question). But still, thanks for helping! :)

Collectives™ on Stack Overflow

Invalid CSRF using symfony2 form type

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related