How to Manually Validate a CSRF Token in a Controller

Warning: You are browsing the documentation for Symfony 3.x, which is no longer maintained.

Read the updated version of this page for Symfony 7.3 (the current stable version).

Sometimes, you want to use CSRF protection in an action where you do not want to use the Symfony Form component. If, for example, you are implementing a DELETE action, you can use the isCsrfTokenValid() method to check the validity of a CSRF token:

        1
2
3
4
5
6
7
8
        use Symfony\Component\HttpFoundation\Request;

public function deleteAction(Request $request)
{
    if ($this->isCsrfTokenValid('token_id', $request->request->get('token_param'))) {
        // ... do something, like deleting an object
    }
}
    

This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.

TOC

Version