Can you please give more insights about what's causing the bug at hand (e.g. which PR introduced it and why)?

Introducing deprecations is preferably avoided at this stage, we need a strong reason for doing so.

The issue stems from the token manager service ID configuration node being called csrf_token_generator. As such it has been wrongly assumed in #46580 (and in the blog post) security.csrf.token_generator was a correct value, whereas security.csrf.token_manager should be used (this is reflected by the documentation).

Introducing deprecations is preferably avoided at this stage, we need a strong reason for doing so.

Okay so changing the default value only should be good. Do you think the configuration could be renamed on 6.3?

Thank you. I'll let @wouterj answer your questions as I didn't follow this change.

This config option has been there since Symfony 2.4 (#9587), so this is not something we should rush for 6.2 imho.

Also, this does not seem to be related to #48339 to me, as the issue talks about an error between 6.2.0-beta3 and 6.2.0-rc1. Nothing changed in relation to this config option between those releases.

this is not something we should rush for 6.2 imho

Okay, I’ll update this PR to only change the default value.

the issue talks about an error between 6.2.0-beta3 and 6.2.0-rc1. Nothing changed in relation to this config option between those releases.

Indeed, but I was able to reproduce the issue against 6.2.0-BETA1 and the error really comes from the csrf_token_generator value set to security.csrf.token_generator when enable_csrf is true.

Yeah sorry I tend to do many things at once in my PRs 😬

Would a deprecation be ok for 6.3?

Thank you @MatTheCat.