Search code examples
phpformssymfonycsrf

How to force my form compoenent to generate a new csrf on each load?


From here Generate new CSRF token without reloading the entire form I learnt there is a method refreshToken() but how and which part of my code below that I use symfony form component, I should modify with that method to force my form to generate a new csrf each time I load my script?

$csrfStorage = new NativeSessionTokenStorage();
$csrfGenerator = new UriSafeTokenGenerator();
$csrfManager = new CsrfTokenManager($csrfGenerator, $csrfStorage);

$formFactory = Forms::createFormFactoryBuilder()
    ->addExtension(new CsrfExtension($csrfManager))
    ->getFormFactory();


$defaultFormTheme = 'bootstrap_3_layout.html.twig';

$vendorDir = realpath(__DIR__.'/../vendor');
$appVariableReflection = new \ReflectionClass('\Symfony\Bridge\Twig\AppVariable');
$vendorTwigBridgeDir = dirname($appVariableReflection->getFileName());
$viewsDir = realpath('twig');

$twig = new Twig_Environment(new Twig_Loader_Filesystem(array(
    $viewsDir,
    $vendorTwigBridgeDir.'/Resources/views/Form',
)));
$formEngine = new TwigRendererEngine(array($defaultFormTheme), $twig);
$twig->addRuntimeLoader(new \Twig_FactoryRuntimeLoader(array(
    TwigRenderer::class => function () use ($formEngine, $csrfManager) {
        return new TwigRenderer($formEngine, $csrfManager);
    },
)));
$twig->addExtension(new FormExtension());

$translator = new Translator('en');
$twig->addExtension(new TranslationExtension($translator));
$form = $formFactory->createBuilder()
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$request = Request::createFromGlobals();
$form->handleRequest();
if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();
    print_r($data);
}

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));


$csrfManager->refreshToken('form');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', array('task' => 'gggg'),  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'form'))
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));

EDIT: Now with the help of answer, it refreshes always, but now the problem is that it is always an invalid form. What wrong I did?

$csrfManager->refreshToken('my_form_id');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'my_form_id'))

->add('task', TextType::class)
->add('dueDate', DateType::class)
->getForm();
$request = Request::createFromGlobals();

$form->handleRequest();

if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();
    print_r($data);
} else {
    print("invalid");
}

What should I do as it is always valid even if it is expected to be valid?

EDIT2:

$csrfManager->refreshToken('form');
$form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', array('task' => 'gggg'),  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'form'))
    ->add('task', TextType::class)
    ->add('dueDate', DateType::class)
    ->getForm();

$twig->display('new.html.twig', array(
    'form' => $form->createView(),
));


$request = Request::createFromGlobals();

    $session = New Session();
    $session->set($formToken, $csrfManager->getToken($formToken)->getValue());
    $request->setSession($session);
    $form->handleRequest();


if ($form->isSubmitted() && $form->isValid()) {
    $data = $form->getData();

print_r($data);
} else {
print("invalid");
}

Solution

  • $csrfManager->refreshToken('my_form_id');
    $form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_token_manager' => $csrfManager, 'csrf_token_id' => 'my_form_id'))
        ->add('task', TextType::class)
        ->add('dueDate', DateType::class)
        ->getForm();
    

    .....

    $request = Request::createFromGlobals();
            $formToken = '_csrf/'.$form->getName();
           // $storage = new NativeSessionStorage();
            $session = New Session();
            $session->set($formToken, $csrfManager->getToken($formToken)->getValue());
            $request->setSession($session);
            $form->handleRequest();
            dump($request->getSession()->all());
    

    To diable the csrf use the option csrf_protection

    $form = $formFactory->createBuilder('Symfony\Component\Form\Extension\Core\Type\FormType', null,  array('csrf_protection' => false))
            ->add('task', TextType::class)
            ->add('dueDate', DateType::class)
            ->getForm();
    

    EDIT : Setting the session

    use Symfony\Component\HttpFoundation\Session\Session;
    ....
    
        $request = Request::createFromGlobals();
        $formToken = '_csrf/'.$form->getName();
        $session = New Session();
        $session->set($formToken,$csrfManager->getToken($formToken)->getValue());
        $request->setSession($session);
        $form->handleRequest();