8000 Tweaks to the new form csrf caching entry by weaverryan · Pull Request #4772 · symfony/symfony-docs · GitHub
[go: up one dir, main page]
Skip to content

Tweaks to the new form csrf caching entry #4772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jan 16, 2015
Merged

Tweaks to the new form csrf caching entry #4772

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1c568e1
[#4141] Tweaks to the new form csrf caching entry
weaverryan Jan 4, 2015
cc40b5c
Adding missing words thanks to javiereguiluz
weaverryan Jan 16, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Adding missing words thanks to javiereguiluz
  • Loading branch information
@weaverryan
weaverryan committed Jan 16, 2015
commit cc40b5ce523a2bebc0b83452c7d213071009b863
6 changes: 3 additions & 3 deletions cookbook/cache/form_csrf_caching.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,9 @@ Why Caching Pages with a CSRF token are Problematic
Typically, each user is assigned a unique CSRF token, which is stored in
the session for validation. This means that if you *do* cache a page with
a form containing a CSRF token, you'll cache the CSRF token of the *first*
user only. When a user submits, the token won't match the token stored in
the session and all users (except for the first) will fail CSRF validation
when submitting the form.
user only. When a user submits the form, the token won't match the token
stored in the session and all users (except for the first) will fail CSRF
validation when submitting the form.

In fact, many reverse proxies (like Varnish) will refuse to cache a page
with a CSRF token. This is because a cookie is sent in order to preserve
Expand Down
0