FriendsOfSymfony/FOSRestBundle — Issue #139: CSRF token
Author: ferrangimenezz
Created: 2011-10-13 19:37:32+00:00
State: open

Hi there again,

I have a client-side app accessing a RESTful server, and for special needs of the application, the forms are coded in the client-side. So I have a problem with the CSRF, and I would like to know how you handle this guys.

CSRF seems a good idea to add security to the app. As I can see, when a form is rendered a token hidden field is generated and then required for the validations. However, when the form is not created by the server app, you don't have this token. How can you get it?

I've thought that before showing any form on the client-side, you could make a "new" restful call to the server and obtain that token, then build the form and submit it to the server with the previous token. But I can't find a way to generate that token. Can anybody help me?

Thanks a lot!