Can you please give more insights about what's causing the bug at hand (e.g. which PR introduced it and why)?

Introducing deprecations is preferably avoided at this stage, we need a strong reason for doing so.

The issue stems from the tokenmanager service ID configuration node being calledcsrf_token_generator. As such it has been wrongly assumed in#46580 (and inthe blog post)security.csrf.token_generator was a correct value, whereassecurity.csrf.token_manager should be used (this is reflected bythe documentation).

Introducing deprecations is preferably avoided at this stage, we need a strong reason for doing so.

Okay so changing the default value only should be good. Do you think the configuration could be renamed on6.3?

Thank you. I'll let@wouterj answer your questions as I didn't follow this change.

This config option has been there since Symfony 2.4 (#9587), so this is not something we should rush for 6.2 imho.

Also, this does not seem to be related to#48339 to me, as the issue talks about an error between 6.2.0-beta3 and 6.2.0-rc1. Nothing changed in relation to this config option between those releases.

this is not something we should rush for 6.2 imho

Okay, I’ll update this PR to only change the default value.

the issue talks about an error between 6.2.0-beta3 and 6.2.0-rc1. Nothing changed in relation to this config option between those releases.

Indeed, but I was able to reproduce the issue against6.2.0-BETA1 and the error really comes from thecsrf_token_generator value set tosecurity.csrf.token_generator whenenable_csrf is true.

Yeah sorry I tend to do many things at once in my PRs 😬

Would a deprecation be ok for6.3?

Thank you@MatTheCat.