8000 Simplified the docs about caching pages with CSRF forms · symfony/symfony-docs@ecb5e62 · GitHub
[go: up one dir, main page]
Skip to content

Commit ecb5e62

Browse files
javiereguiluzjaviereguiluz
committed
Simplified the docs about caching pages with CSRF forms
1 parent a425cc3 commit ecb5e62

File tree

6 files changed

+20
-57
lines changed

6 files changed

+20
-57
lines changed

‎_build/redirection_map

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,3 +401,4 @@
401401
/weblink /web_link
402402
/components/weblink /components/web_link
403403
/frontend/encore/installation-no-flex /frontend/encore/installation
404+
/http_cache/form_csrf_caching /security/csrf

‎forms.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ Learn more
714714
/form/*
715715
/controller/upload_file
716716
/reference/forms/types
717-
/http_cache/form_csrf_caching
717+
/security/csrf
718718

719719
.. _`Symfony Form component`: https://github.com/symfony/form
720720
.. _`DateTime`: https://php.net/manual/en/class.datetime.php

‎http_cache/form_csrf_caching.rst

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎http_cache/varnish.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ at least for some parts of the site, e.g. when using forms with
6565
:doc:`CSRF Protection </security/csrf>`. In this situation, make sure to
6666
:doc:`only start a session when actually needed </session/avoid_session_start>`
6767
and clear the session when it is no longer needed. Alternatively, you can look
68-
into :doc:`/http_cache/form_csrf_caching`.
68+
into :doc:`/security/csrf`.
6969

7070
Cookies created in JavaScript and used only in the frontend, e.g. when using
7171
Google Analytics, are nonetheless sent to the server. These cookies are not

‎performance.rst

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,6 @@ Learn more
138138
----------
139139

140140
* :doc:`/http_cache/varnish`
141-
* :doc:`/http_cache/form_csrf_caching`
142141

143142
.. _`byte code caches`: https://en.wikipedia.org/wiki/List_of_PHP_accelerators
144143
.. _`OPcache`: https://php.net/manual/en/book.opcache.php

‎security/csrf.rst

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,22 @@ for more information):
5555
'csrf_protection' => null,
5656
));
5757
58+
The tokens used for CSRF protection are meant to be different for every user and
59+
they are stored in the session. That's why a session is started automatically as
60+
soon as you render a form with CSRF protection.
61+
62+
.. _caching-pages-that-contain-csrf-protected-forms:
63+
64+
Moreover, this means that you cannot fully cache pages that include CSRF
65+
protected forms. As an alternative, you can:
66+
67+
* Embed the form inside an uncached :doc:`ESI fragment </http_cache/esi>` and
68+
cache the rest of the page contents;
69+
* Cache the entire page and load the form via an uncached AJAX request;
70+
* Cache the entire page and use :doc:`hinclude.js </templating/hinclude>` to
71+
load just the CSRF token with an uncached AJAX request and replace the form
72+
field value with it.
73+
5874
CSRF Protection in Symfony Forms
5975
--------------------------------
6076

@@ -92,17 +108,6 @@ this can be customized on a form-by-form basis::
92108
// ...
93109
}
94110

95-
.. caution::
96-
97-
Since the token is stored in the session, a session is started automatically
98-
as soon as you render a form with CSRF protection.
99-
100-
.. caution::
101-
102-
CSRF tokens are meant to be different for every user. Beware of that when
103-
caching pages that include forms containing CSRF tokens. For more
104-
information, see :doc:`/http_cache/form_csrf_caching`.
105-
106111
CSRF Protection in Login Forms
107112
------------------------------
108113

@@ -113,6 +118,7 @@ CSRF Protection in HTML Forms
113118
-----------------------------
114119

115120
.. versionadded:: 4.1
121+
116122
In Symfony versions prior to 4.1, CSRF support required installing the
117123
Symfony Form component even if you didn't use it.
118124

0 commit comments

Comments
 (0)
0