How to Manually Validate a CSRF Token in a Controller

Version: 3.2
Edit this page

Warning: You are browsing the documentation for Symfony 3.2, which is no longer maintained.

Read the updated version of this page for Symfony 6.0 (the current stable version).

How to Manually Validate a CSRF Token in a Controller

Sometimes, you want to use CSRF protection in an action where you do not want to use the Symfony Form component. If, for example, you are implementing a DELETE action, you can use the isCsrfTokenValid() method to check the validity of a CSRF token:

1
2
3
4
5
6
public function deleteAction()
{
    if ($this->isCsrfTokenValid('token_id', $submittedToken)) {
        // ... do something, like deleting an object
    }
}
This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.