8000 finish csrf_token_generator and csrf_token_id docs · symfony/symfony-docs@304d7a5 · GitHub
[go: up one dir, main page]
Skip to content

Commit 304d7a5

Browse files
xabbuhxabbuh
committed
finish csrf_token_generator and csrf_token_id docs
1 parent 3ceb61c commit 304d7a5

File tree

3 files changed

+26
-14
lines changed

3 files changed

+26
-14
lines changed

‎book/forms.rst

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1809,7 +1809,7 @@ The CSRF token can be customized on a form-by-form basis. For example::
18091809
'csrf_protection' => true,
18101810
'csrf_field_name' => '_token',
18111811
// a unique key to help generate the secret token
1812-
'intention' => 'task_item',
1812+
'csrf_token_id' => 'task_item',
18131813
));
18141814
}
18151815

@@ -1825,8 +1825,12 @@ section.
18251825

18261826
.. note::
18271827

1828-
The ``intention`` option is optional but greatly enhances the security of
1829-
the generated token by making it different for each form.
1828+
The ``csrf_token_id`` option is optional but greatly enhances the security
1829+
of the generated token by making it different for each form.
1830+
1831+
.. versionadded:: 2.4
1832+
The ``csrf_token_id`` option was introduced in Symfony 2.4. Prior, you
1833+
had to use the ``intention`` option.
18301834

18311835
.. caution::
18321836

‎cookbook/security/csrf_in_login_form.rst

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ provider available in the Security component:
5050
5151
<firewall name="secured_area">
5252
<!-- ... -->
53-
<form-login csrf-provider="security.csrf.token_manager" />
53+
<form-login csrf-token-generator="security.csrf.token_manager" />
5454
</firewall>
5555
</config>
5656
</srv:container>
@@ -72,6 +72,10 @@ provider available in the Security component:
7272
),
7373
));
7474
75+
.. versionadded:: 2.4
76+
The ``csrf_token_generator`` option was introduced in Symfony 2.4. Prior,
77+
you had to use the ``csrf_provider`` option.
78+
7579
The Security component can be configured further, but this is all information
7680
it needs to be able to use CSRF in the login form.
7781

@@ -156,7 +160,7 @@ After this, you have protected your login form against CSRF attacks.
156160
<firewall name="secured_area">
157161
<!-- ... -->
158162
<form-login csrf-parameter="_csrf_security_token"
159-
csrf_token_id="a_private_string"
163+
csrf-token-id="a_private_string"
160164
/>
161165
</firewall>
162166
</config>
@@ -180,10 +184,9 @@ After this, you have protected your login form against CSRF attacks.
180184
),
181185
));
182186
183-
.. versionadded:: 2.8
184-
The ``intention`` and ``csrf_token_generator`` options were introduced
185-
in Symfony 2.8. Prior, you had to use the ``csrf_token_id`` and ``csrf_provider``
186-
options.
187+
.. versionadded:: 2.4
188+
The ``csrf_token_id`` option was introduced in Symfony 2.4. Prior, you
189+
had to use the ``intention`` option.
187190

188191
.. _`Cross-site request forgery`: https://en.wikipedia.org/wiki/Cross-site_request_forgery
189192
.. _`Forging Login Requests`: https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests

‎reference/configuration/security.rst

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ Each part will be explained in the next section.
1717
Support for restricting security firewalls to specific http methods was introduced in
1818
Symfony 2.5.
1919

20+
.. versionadded:: 2.4
21+
The ``csrf_token_generator`` and ``csrf_token_id`` were introduced in
22+
Symfony 2.4. Prior, you had to use the ``csrf_provider`` and ``intention``
23+
options.
24+
2025
.. configuration-block::
2126

2227
.. code-block:: yaml
@@ -165,9 +170,9 @@ Each part will be explained in the next section.
165170
password_parameter: _password
166171
167172
# csrf token options
168-
csrf_parameter: _csrf_token
169-
intention: authenticate
170-
csrf_provider: my.csrf_provider.id
173+
csrf_parameter: _csrf_token
174+
csrf_token_id: authenticate
175+
csrf_token_generator: my.csrf_token_generator.id
171176
172177
# by default, the login form *must* be a POST, not a GET
173178
post_only: true
@@ -213,8 +218,8 @@ Each part will be explained in the next section.
213218
context: ~
214219
logout:
215220
csrf_parameter: _csrf_token
216-
csrf_provider: ~
217-
intention: logout
221+
csrf_token_generator: ~
222+
csrf_token_id: logout
218223
path: /logout
219224
target: /
220225
success_handler: ~

0 commit comments

Comments
 (0)
0