Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 8d67740

Browse filesBrowse files
javiereguiluzjaviereguiluz
committed
minor #10877 Simplified the docs about caching pages with CSRF forms (javiereguiluz)
This PR was squashed before being merged into the 4.1 branch (closes #10877). Discussion ---------- Simplified the docs about caching pages with CSRF forms The `http_cache/form_csrf_caching` article is one of those micro-articles that we want to remove (the little they explain can be embedded in other articles to avoid breaking reading flow too much). Commits ------- ecb5e62 Simplified the docs about caching pages with CSRF forms
2 parents 2faef73 + ecb5e62 commit 8d67740
Copy full SHA for 8d67740

File tree

Expand file treeCollapse file tree

6 files changed

+19
-57
lines changed
Filter options
Expand file treeCollapse file tree

6 files changed

+19
-57
lines changed

‎_build/redirection_map

Copy file name to clipboardExpand all lines: _build/redirection_map
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,3 +401,4 @@
401401
/weblink /web_link
402402
/components/weblink /components/web_link
403403
/frontend/encore/installation-no-flex /frontend/encore/installation
404+
/http_cache/form_csrf_caching /security/csrf

‎forms.rst

Copy file name to clipboardExpand all lines: forms.rst
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ Learn more
714714
/form/*
715715
/controller/upload_file
716716
/reference/forms/types
717-
/http_cache/form_csrf_caching
717+
/security/csrf
718718

719719
.. _`Symfony Form component`: https://github.com/symfony/form
720720
.. _`DateTime`: https://php.net/manual/en/class.datetime.php

‎http_cache/form_csrf_caching.rst

Copy file name to clipboardExpand all lines: http_cache/form_csrf_caching.rst
-43Lines changed: 0 additions & 43 deletions
This file was deleted.

‎http_cache/varnish.rst

Copy file name to clipboardExpand all lines: http_cache/varnish.rst
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ at least for some parts of the site, e.g. when using forms with
6565
:doc:`CSRF Protection </security/csrf>`. In this situation, make sure to
6666
:doc:`only start a session when actually needed </session/avoid_session_start>`
6767
and clear the session when it is no longer needed. Alternatively, you can look
68-
into :doc:`/http_cache/form_csrf_caching`.
68+
into :doc:`/security/csrf`.
6969

7070
Cookies created in JavaScript and used only in the frontend, e.g. when using
7171
Google Analytics, are nonetheless sent to the server. These cookies are not

‎performance.rst

Copy file name to clipboardExpand all lines: performance.rst
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,6 @@ Learn more
138138
----------
139139

140140
* :doc:`/http_cache/varnish`
141-
* :doc:`/http_cache/form_csrf_caching`
142141

143142
.. _`byte code caches`: https://en.wikipedia.org/wiki/List_of_PHP_accelerators
144143
.. _`OPcache`: https://php.net/manual/en/book.opcache.php

‎security/csrf.rst

Copy file name to clipboardExpand all lines: security/csrf.rst
+16-11Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,22 @@ for more information):
5555
'csrf_protection' => null,
5656
));
5757
58+
The tokens used for CSRF protection are meant to be different for every user and
59+
they are stored in the session. That's why a session is started automatically as
60+
soon as you render a form with CSRF protection.
61+
62+
.. _caching-pages-that-contain-csrf-protected-forms:
63+
64+
Moreover, this means that you cannot fully cache pages that include CSRF
65+
protected forms. As an alternative, you can:
66+
67+
* Embed the form inside an uncached :doc:`ESI fragment </http_cache/esi>` and
68+
cache the rest of the page contents;
69+
* Cache the entire page and load the form via an uncached AJAX request;
70+
* Cache the entire page and use :doc:`hinclude.js </templating/hinclude>` to
71+
load just the CSRF token with an uncached AJAX request and replace the form
72+
field value with it.
73+
5874
CSRF Protection in Symfony Forms
5975
--------------------------------
6076

@@ -92,17 +108,6 @@ this can be customized on a form-by-form basis::
92108
// ...
93109
}
94110

95-
.. caution::
96-
97-
Since the token is stored in the session, a session is started automatically
98-
as soon as you render a form with CSRF protection.
99-
100-
.. caution::
101-
102-
CSRF tokens are meant to be different for every user. Beware of that when
103-
caching pages that include forms containing CSRF tokens. For more
104-
information, see :doc:`/http_cache/form_csrf_caching`.
105-
106111
CSRF Protection in Login Forms
107112
------------------------------
108113

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.