Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit304d7a5

Browse files
committed
finish csrf_token_generator and csrf_token_id docs
1 parent3ceb61c commit304d7a5

File tree

3 files changed

+26
-14
lines changed

3 files changed

+26
-14
lines changed

‎book/forms.rst‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1809,7 +1809,7 @@ The CSRF token can be customized on a form-by-form basis. For example::
18091809
'csrf_protection' => true,
18101810
'csrf_field_name' => '_token',
18111811
// a unique key to help generate the secret token
1812-
'intention' => 'task_item',
1812+
'csrf_token_id' => 'task_item',
18131813
));
18141814
}
18151815

@@ -1825,8 +1825,12 @@ section.
18251825

18261826
..note::
18271827

1828-
The ``intention`` option is optional but greatly enhances the security of
1829-
the generated token by making it different for each form.
1828+
The ``csrf_token_id`` option is optional but greatly enhances the security
1829+
of the generated token by making it different for each form.
1830+
1831+
..versionadded::2.4
1832+
The ``csrf_token_id`` option was introduced in Symfony 2.4. Prior, you
1833+
had to use the ``intention`` option.
18301834

18311835
..caution::
18321836

‎cookbook/security/csrf_in_login_form.rst‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ provider available in the Security component:
5050
5151
<firewallname="secured_area">
5252
<!-- ...-->
53-
<form-logincsrf-provider="security.csrf.token_manager" />
53+
<form-logincsrf-token-generator="security.csrf.token_manager" />
5454
</firewall>
5555
</config>
5656
</srv:container>
@@ -72,6 +72,10 @@ provider available in the Security component:
7272
),
7373
));
7474
75+
..versionadded::2.4
76+
The ``csrf_token_generator`` option was introduced in Symfony 2.4. Prior,
77+
you had to use the ``csrf_provider`` option.
78+
7579
The Security component can be configured further, but this is all information
7680
it needs to be able to use CSRF in the login form.
7781

@@ -156,7 +160,7 @@ After this, you have protected your login form against CSRF attacks.
156160
<firewallname="secured_area">
157161
<!-- ...-->
158162
<form-logincsrf-parameter="_csrf_security_token"
159-
csrf_token_id="a_private_string"
163+
csrf-token-id="a_private_string"
160164
/>
161165
</firewall>
162166
</config>
@@ -180,10 +184,9 @@ After this, you have protected your login form against CSRF attacks.
180184
),
181185
));
182186
183-
..versionadded::2.8
184-
The ``intention`` and ``csrf_token_generator`` options were introduced
185-
in Symfony 2.8. Prior, you had to use the ``csrf_token_id`` and ``csrf_provider``
186-
options.
187+
..versionadded::2.4
188+
The ``csrf_token_id`` option was introduced in Symfony 2.4. Prior, you
189+
had to use the ``intention`` option.
187190

188191
.. _`Cross-site request forgery`:https://en.wikipedia.org/wiki/Cross-site_request_forgery
189192
.. _`Forging Login Requests`:https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests

‎reference/configuration/security.rst‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ Each part will be explained in the next section.
1717
Support for restricting security firewalls to specific http methods was introduced in
1818
Symfony 2.5.
1919

20+
..versionadded::2.4
21+
The ``csrf_token_generator`` and ``csrf_token_id`` were introduced in
22+
Symfony 2.4. Prior, you had to use the ``csrf_provider`` and ``intention``
23+
options.
24+
2025
..configuration-block::
2126

2227
..code-block::yaml
@@ -165,9 +170,9 @@ Each part will be explained in the next section.
165170
password_parameter:_password
166171
167172
# csrf token options
168-
csrf_parameter:_csrf_token
169-
intention:authenticate
170-
csrf_provider:my.csrf_provider.id
173+
csrf_parameter:_csrf_token
174+
csrf_token_id:authenticate
175+
csrf_token_generator:my.csrf_token_generator.id
171176
172177
# by default, the login form *must* be a POST, not a GET
173178
post_only:true
@@ -213,8 +218,8 @@ Each part will be explained in the next section.
213218
context:~
214219
logout:
215220
csrf_parameter:_csrf_token
216-
csrf_provider:~
217-
intention:logout
221+
csrf_token_generator:~
222+
csrf_token_id:logout
218223
path:/logout
219224
target:/
220225
success_handler:~

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp