Symfony 4 - how to add csrf token without building form?

Question

I am reading tutorial here

https://symfony.com/doc/current/form/csrf_protection.html

how to add csrf token. It says to use

form_end()

in the template. But this is not working, gives error:

Type error: Too few arguments to function Symfony\Component\Form\FormRenderer::renderBlock(), 0 passed in E:\projektai\php projektai\htdocs\mokomieji\symfony_4_demo\var\cache\dev\twig\bb\bb2248f7be504240fcc2ab43dabf593090ebc4c897ce72b1a979082d62914b47.php on line 48 and at least 2 expected

Here is answer which shows how to fix but it is only when you have form object built:

Symfony Type error: Too few arguments to function FormRenderer::renderBlock()

How to do this without having form object? Here is login from login documentation page:

{% if error %}
    <div>{{ error.messageKey|trans(error.messageData, 'security') }}</div>
{% endif %}

<form action="{{ path('login') }}" method="post">
    <label for="username">Username:</label>
    <input type="text" id="username" name="_username" value="{{ last_username }}" />

    <label for="password">Password:</label>
    <input type="password" id="password" name="_password" />

    <button type="submit">Login</button>

{{  form_end() }}

Matteo · Accepted Answer · 2017-12-18 16:22:02Z

21

You can use the helper twig function csrf_token as described in the doc here, as example:

 <input type="hidden" name="_csrf_token"
        value="{{ csrf_token('authenticate') }}"
    >

2 Comments

Dariux Over a year ago

This does give error: An exception has been thrown during the rendering of a template ("CSRF tokens can only be generated if a CsrfTokenManagerInterface is injected in FormRenderer::__construct().").

Noob Over a year ago

what is "example" stand for in gettoken?

Sentence · Accepted Answer · 2018-03-28 14:56:32Z

11

You can use {{ form_row(form._token) }} to generate the required CSRF token field to your form render in Symfony 3 (i'm currenlty use this method with Symfony 3.4).

answered Mar 28, 2018 at 14:56

Sentence

3005 silver badges10 bronze badges

Comments

Generwp · Accepted Answer · 2017-12-18 16:05:12Z

4

{{ form_end() }} works only if you have something like this:

{{ form_start(form) }}
{{ form_widget(form) }}
{{ form_end(form) }}

You can create custom token in your controller and then pass it to the view like this:

    $csrf = $this->container->get('security.csrf.token_manager');
    $token = $csrf->refreshToken('yourkey');

And then create hidden input in your twig with token:

<input type="hidden" name="_token" value="{{ token }}">

answered Dec 18, 2017 at 16:05

Generwp

5144 silver badges17 bronze badges

Comments

Victor Timoftii · Accepted Answer · 2019-06-17 14:03:17Z

0

To get the right csrf_token you should create the FormView with $form->createView(), then use the token inside it:

<input type="hidden" name="_token" value="{{ form._token.vars.value }}">

All the other solutions rely on generating a static string that does not change, which violates the purpose of the csrf tokens.

answered Jun 17, 2019 at 14:03

Victor Timoftii

3,4381 gold badge18 silver badges17 bronze badges

Comments

someone · Accepted Answer · 2023-09-07 01:48:31Z

0

For those who are looking for how to generate CSRF tokens inside your Controller methods:

    public function myMethod (
        CsrfTokenManagerInterface $csrfTokenManager
    ): JsonResponse
    {
        // validate token
        // $csrf_token = new CsrfToken('my_token', 'generated_token_value_here');
        // if(!$csrfTokenManager->isTokenValid($csrf_token)) {
        //     //failed. do something.
        //     return new JsonResponse();
        // }
        
        // generate token
        $token = $csrfTokenManager->getToken('my_token')->getValue();
        
        // refresh token
        // $csrfTokenManager->refreshToken('my_token');
        
        return new JsonResponse([
            "token'" => $token
        ]);
    }

edited Sep 7, 2023 at 1:48

answered Sep 7, 2023 at 0:46

someone

2042 silver badges6 bronze badges

Collectives™ on Stack Overflow

Symfony 4 - how to add csrf token without building form?

5 Answers 5

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related