New in Symfony 7.1: IsCsrfTokenValid Attribute

May 7, 2024 • Published by Avatar of Javier Eguiluz Javier Eguiluz

Symfony 7.1 is backed by:

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.
At Rector, we help successful and growing companies to get the most of the code they already have. Including upgrading to the latest Symfony LTS. We deliver automated refactoring, reduce maintenance costs, speed up feature delivery, and transform legacy code into a strategic asset. Let us handle the dirty work, so you can focus on the features.
Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!
Yassine Guedidi

Contributed by
Yassine Guedidi
in #52961 and #54443.

CSRF (Cross-site Request Forgery) attacks are used by malicious users to make your legitimate users submit data unknowingly. In Symfony we provide full protection against CSRF attacks thanks to the SecurityCsrf component.

The following is a common code snippet used in controllers that extend Symfony's AbstractController to check that the CSRF token of the form is valid:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;

class BlogPostController extends AbstractController
{
    // ...

    public function delete(): Response
    {
        if (!$this->isCsrfTokenValid('delete_example', $request->request->getString('_token'))) {
            throw new BadRequestHttpException('This token is invalid');
        }

        // ...
    }
}

In Symfony 7.1 we're introducing a new #[IsCsrfTokenValid] attribute to make this code simpler:

1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;

class BlogPostController
{
    // ...

    #[IsCsrfTokenValid('delete_example')]
    public function delete(): Response
    {
        // ...
    }
}

Another common need is to check multiple similar CSRF tokens. For example, in a listing of blog posts, each one has a slightly different delete form:

1
2
3
4
5
6
7
{% for post in blog_posts %}
    {# ... #}

    <form action="{{ path('post_delete', {post: post.id}) }}" method="POST">
        <input type="hidden" name="_token" value="{{ csrf_token('delete-post-' ~ post.id) }}">
    </form>
{% endfor %}

This can also be solved with the #[IsCsrfTokenValid] attribute because it supports expressions compatible with the ExpressionLanguage component:

1
2
3
4
5
6
7
8
9
10
11
12
13
// ...
use Symfony\Component\ExpressionLanguage\Expression;

class BlogPostController
{
    // ...

    #[IsCsrfTokenValid(new Expression('"delete-post-" ~ args["post"].id'))]
    public function delete(Request $request, Post $post): Response
    {
        // ...
    }
}
Published in #Living on the edge

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Comments

Avatar of Cédric Bertolini
Cédric Bertolini said on May 7, 2024
Very handy! Am I wrong in thinking the "tokenKey" argument in the second code block should be "_token" instead of "token", to really be equivalent to the first code block?
Avatar of Javier Eguiluz
Javier Eguiluz Certified said on May 9, 2024
@Cédric you are right. I've just updated the blog post to remove the "tokenKey" option because you don't have to define it when the token name is "_token", which is the default name. Thanks!
Avatar of Sébastien JEAN
Sébastien JEAN said on May 18, 2024
But how can this be coded for the following projects?
- https://github.com/symfony/demo/blob/main/src/Controller/Admin/BlogController.php#L168
- https://github.com/symfony/maker-bundle/blob/main/src/Resources/skeleton/crud/controller/Controller.tpl.php#L85

What should I do if the CSRF token is not valid?
Avatar of Álvaro Neves
Álvaro Neves said on Jun 25, 2024
As said before by Sébastien JEAN, there is no default handler to an invalid or even a way to implement this method. The better way is to create an interface or an abstract class that we can implement the verification, in case of the _token in the header instead of the payload for example.

Comments are closed.

To ensure that comments stay relevant, they are closed for old posts.