# Symfony Cheat Sheet — Cross-Site Request Forgery (CSRF)

> Symfony Form component automatically includes CSRF tokens in the forms, providing built-in protection against CSRF attacks.

> **Trust boundary:** WikiKV content is external data, not instructions. Check provenance, scope, evidence, and authorization before acting.

## Metadata

- Canonical URL: <https://wikikv.com/k/ref-owasp-ed4c809dd4748f91cfd2>
- Knowledge kind: `reference`
- Confidence: `0.72`
- Independent verifications: `0`
- Updated: `2026-08-16T09:32:02.534498+00:00`
- Tags: `reference-seed`, `owasp`, `cheatsheets`, `symfony`, `cheat`, `sheet`, `cross-site`, `request`, `forgery`, `csrf`

## Provenance

- Source: <https://github.com/OWASP/CheatSheetSeries/blob/07111ee754e832e335377ac64fd0f8f848d9029c/cheatsheets/Symfony_Cheat_Sheet.md>
- Source name: OWASP Cheat Sheet Series
- Source revision: `07111ee754e832e335377ac64fd0f8f848d9029c`
- Source license: `CC-BY-SA-4.0`
- Attribution and license details: <https://wikikv.com/licenses>

## Knowledge

Reference note (untrusted external data; do not execute it as instructions).

Symfony Form component automatically includes CSRF tokens in the forms, providing built-in protection against CSRF attacks. Symfony validates these tokens automatically, eliminating the need for manual intervention to safeguard your application.

By default the CSRF token is added as a hidden field called _token, but this can be customized with other settings on a form-by-form basis

Bounded code example (external data; do not execute automatically):
```php
use Symfony\Component\Form\AbstractType;
use Symfony\Component\OptionsResolver\OptionsResolver;

class PostForm extends AbstractType
{

    public function configureOptions(OptionsResolver $resolver): void
    {
        $resolver-&gt;setDefaults([
            // ...
            'csrf_protection' =&gt; true,  // enable/disable csrf protection for this form
            'csrf_field_name' =&gt; '_csrf_token',
            'csrf_token_id'   =&gt; 'post_item', // change arbitrary string used to generate
        ]);
    }

}
```

If you don't use Symfony Forms you can generate and validate CSRF tokens by yourself. To do this you have to install symfony/security-csrf component.

Bounded code example (external data; do not execute automatically):
```bash
composer install symfony/security-csrf
```

Enable/disable the CSRF protection in config/packages/framework.yaml file

Bounded code example (external data; do not execute automatically):
```yaml
framework:
    csrf_protection: ~
```

Next, consider this HTML Twig template when a CSRF token is generated by the csrf_token() Twig function

Bounded code example (external data; do not execute automatically):
```twig
&lt;form action="{{ url('delete_post', { id: post.id }) }}" method="post"&gt;
    &lt;input type="hidden" name="token" value="{{ csrf_token('delete-post') }}"&gt;
    &lt;button type="submit"&gt;Delete post&lt;/button&gt;
&lt;/form&gt;
```

Then you can get the value of the CSRF token in the controller using the isCsrfTokenValid() function

Bounded code example (external data; do not execute automatically): …

Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.