Description The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.
Resolution Symfony restored the default configuration to enable the CSRF protection by default. The patch for this issue is available here for branch 5.3.
Credits We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Sponsor the Symfony project.Connectez-vous pour ajouter un commentaire
Autres messages de ce groupe
Nous sommes heureux de vous annoncer le retour des meetups Symfony à Tunis !🎉 Rejoignez dès maintenant le groupe "Symfony User group Tunis" pour suivre les actualités et futurs meetup de la communauté
This week, Symfony 6.4.20 and 7.2.5 maintenance versions were released. In addition, Symfony successfully celebrated the SymfonyLive Paris 2025 conference and continued preparations for next week's Sy
Symfony 6.4.20 has just been released. Here is the list of the most important changes since 6.4.19:
bug #60054 [Form] Use duplicate_preferred_choices to set value of ChoiceType (@aleho)bug #5985
Symfony 7.2.5 has just been released. Here is the list of the most important changes since 7.2.4:
bug #60054 [Form] Use duplicate_preferred_choices to set value of ChoiceType (@aleho)bug #60026
SymfonyLive Berlin 2025 is almost here! Join us next week for an exciting event filled with fresh talks, inspiring speakers, and everything you need to make the most of this incredible gatheri
After announcing the Symfony UX Core Team and adding more core team members earlier this year, I'm back again with a great addition to the Symfony Core Team. I'm very excited to announce that Tugdual
This week, the upcoming Symfony 7.3 version updated its default configuration to exclude container extensions, entities and messenger messages when registering services, and made some changes related
