Warning: You are browsing the documentation for Symfony 2.7, which is no longer maintained.

Read the updated version of this page for Symfony 5.3 (the current stable version).

How to Manually Validate a CSRF Token in a Controller

2.7 version

Maintained

4.4 5.3 current 5.4 dev 6.0

Unmaintained

2.7 2.8 3.0 3.1 3.2 3.3 3.4 4.0 4.1 4.2 4.3 5.0 5.1 5.2

How to Manually Validate a CSRF Token in a Controller¶

Sometimes, you want to use CSRF protection in an action where you do not want to use the Symfony Form component. If, for example, you are implementing a DELETE action, you can use the isCsrfTokenValid() method to check the validity of a CSRF token:

public function deleteAction()
{
    if ($this->isCsrfTokenValid('token_id', $submittedToken)) {
        // ... do something, like deleting an object
    }
}

New in version 2.6: The isCsrfTokenValid() shortcut method was introduced in Symfony 2.6. It is equivalent to executing the following code:

use Symfony\Component\Security\Csrf\CsrfToken;

$this->get('security.csrf.token_manager')
    ->isTokenValid(new CsrfToken('token_id', 'TOKEN'));

This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.