symfony/symfony — pull request #6554 by bschussek (2013-01-04 15:05:59+00:00)
Title: [Form] Improved the CSRF providers to return unguessable tokens

Bug fix: yes
Feature addition: no
Backwards compatibility break: no
Symfony2 tests pass: yes
Fixes the following tickets: -
Todo: -
License of the code: MIT
Documentation PR: TODO

This PR simplifies the CSRF mechanism to generate completely random tokens. A random token is generated once per intention and then stored in the session. Tokens are valid until the session expires.

##### Issues to be solved

The CSRF providers now depends on `SecureRandom` and `StringUtils` from the security component. Right now, the used CSRF provider is configured in FrameworkBundle, which has no dependency on Security (or SecurityBundle).

Possible solutions:

* Move the CSRF provider configuration to SecurityBundle. This will only make CSRF protection work if SecurityBundle is used.
* Split the Security component into smaller Compser packages, i.e. `symfony/security-core`, `symfony/security-acl` and `symfony/security-http` (with a meta package `symfony/security`). Make FrameworkBundle depend on `symfony/security-core` only.

Opinions?

##### TODO

The documentation needs to be checked for references to the configuration of the application secret. Remarks that the secret is used for CSRF protection need to be removed.