Home/ Questions/Q 6345179
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T20:46:19+00:00

Here is my form: <form novalidate action=<?php echo url_for(‘article/submit’) ?> method=POST> <?php echo $form[‘title’]->renderRow()

  • 0

Here is my form:

<form novalidate action="<?php echo url_for('article/submit') ?>" method="POST">
  <?php echo $form['title']->renderRow() ?>
  <?php echo $form['content']->renderRow() ?>
  <?php echo $form->renderHiddenFields() ?>
  <input type="submit" value="Save"/>
</form>

And looking at the generated HTML source, the _csrf_token IS in fact being rendered. Here is my action:

public function executeSubmit(sfWebRequest $request)
{
  $this->forward404Unless($request->isMethod('post'));
  $request->checkCSRFProtection();

  die('submitting post...');
}

The error:

_csrf_token [CSRF attack detected.]

Even in my action if I do a var_dump($_POST); die; I get:

Array
(
  [title] => string(8) "My title"
  [content] => string(10) "My Content"
  [_csrf_token] => string(32) "<my token here>"
)

So the csrf token is definitely being rendered and passed correctly. What am I doing wrong?

Also, is there any documentation for checkCSRFProtection() anywhere? The API doc’s dont’ say anything about it besides acknowledging it’s existence.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A few things to check:

    (Source: From http://oldforum.symfony-project.org/index.php/t/17867/)

    Be sure you have defined your “secret” in your settings:

    csrf_secret: ThisIsMySecret  # Unique secret to enable CSRF protection or false to disable`

    Also, based on what I’ve gathered from that form post, CSRF protection checking is done automatically in $this->form->isValid(), so your call to $request->checkCSRFProtection() is unnecessary if you are already checking if the form is valid. If not, add $this->form->isValid().

    It would also seem that $request->checkCSRFProtection() doesn’t work with forms; it’s purpose (if I’m correct) is to validate requests served when a user clicks a link. When CSRF protection is enabled, link_to() automatically adds CSRF protection to the links it generates. So, basically, the CSRF protection for a form is different for that of a request that didn’t originate from a form.

    See this ticket for more details: http://trac.symfony-project.org/ticket/7315

    Another ticket that may be of interest: http://trac.symfony-project.org/ticket/5698

    • 0