How to disable csrf in symfony?

Question

I used the code below and it has csrf too. But how can I disable its csrf? I searched and Disable CSRF token on login form did not help, as there createFormBuilder() is not used in my case below, so what should I do?

$csrfStorage = new NativeSessionTokenStorage();
$csrfGenerator = new UriSafeTokenGenerator();
$csrfManager = new CsrfTokenManager($csrfGenerator, $csrfStorage);

$formFactory = Forms::createFormFactoryBuilder()
    ->addExtension(new CsrfExtension($csrfManager))
    ->getFormFactory();


$defaultFormTheme = 'bootstrap_3_layout.html.twig';

$vendorDir = realpath(__DIR__.'/../vendor');
$appVariableReflection = new \ReflectionClass('\Symfony\Bridge\Twig\AppVariable');
$vendorTwigBridgeDir = dirname($appVariableReflection->getFileName());
$viewsDir = realpath('twig');

$twig = new Twig_Environment(new Twig_Loader_Filesystem(array(
    $viewsDir,
    $vendorTwigBridgeDir.'/Resources/views/Form',
)));
$formEngine = new TwigRendererEngine(array($defaultFormTheme), $twig);
$twig->addRuntimeLoader(new \Twig_FactoryRuntimeLoader(array(
    TwigRenderer::class => function () use ($formEngine, $csrfManager) {
        return new TwigRenderer($formEngine, $csrfManager);
    },
)));
$twig->addExtension(new FormExtension());

$translator = new Translator('en');
$twig->addExtension(new TranslationExtension($translator));
$form = $formFactory->createBuilder()
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$request = Request::createFromGlobals();
$form->handleRequest();
if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();
    print_r($data);
}

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));

Update your builder part to createBuilder('', null, ['csrf_protection' => false]) — Mert Öksüz
– Mert Öksüz, Commented Nov 12, 2017 at 14:21
I get Error 0: Could not load type "". I guess because first parameter cannot be null? what should I pass into it? — Joe Hark
– Joe Hark, Commented Nov 12, 2017 at 14:49
You should pass FormType, your own formtype which you created. — Mert Öksüz
– Mert Öksüz, Commented Nov 12, 2017 at 14:50
If you want to disable csrf for everything then set config.yml framework csrf_protection to false. But I really don't understand why you are adding the csrf manager if you don't want csrf protection. — Cerad
– Cerad, Commented Nov 12, 2017 at 15:47

Mohamed Ben HEnda · Accepted Answer · 2017-11-12 15:42:39Z

19

$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_protection' => false))

answered Nov 12, 2017 at 15:42

Mohamed Ben HEnda

2,8162 gold badges33 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Tofandel · Accepted Answer · 2022-02-11 20:24:15Z

10

To disable it globally for all of the forms (if for example you want to implement your own logic)

You can set in your config/packages/framework.yaml

framework:
  form:
    csrf_protection:
      enabled: false

edited Feb 11, 2022 at 20:24

answered Feb 11, 2022 at 20:14

Tofandel

3,6451 gold badge41 silver badges58 bronze badges

Comments

Arek PHP · Accepted Answer · 2024-06-20 11:02:24Z

0

To disable csrf protection for single form you can do it like that:

<?php

namespace App\Form;

use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolver;

class ExampleType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options): void
    {
        ...
    }

    public function configureOptions(OptionsResolver $resolver): void
    {
        $resolver
            ->setDefaults([
                'csrf_protection' => false, // todo: add it to disable csrf protection
            ]);
    }
}

edited Jun 20, 2024 at 11:02

answered Jun 20, 2024 at 10:23

Arek PHP

651 silver badge7 bronze badges

4 Comments

Nico Haase Over a year ago

Please add some explanation to your answer such that others can learn from it. How does your answer differ from the one by Mohamed posted more than six years ago?

Arek PHP Over a year ago

@NicoHaase This post is the first result in google on term "How to disable csrf in symfony?" and it does not contains this answer so i added it. We can use configureOptions() in new form type class

Nico Haase Over a year ago

Please add all clarification to your answer by editing it. The code from the question does not even use any form type

Arek PHP Over a year ago

Is it ok right now, after i paste entire type class?

Collectives™ on Stack Overflow

How to disable csrf in symfony?

3 Answers 3

Comments

Comments

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related