[Security] Rename logout’s`csrf_token_generator` to`csrf_token_manager`#17482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

OskarStark merged 1 commit intosymfony:6.3fromMatTheCat:logout-csrf-token-generator

Jan 30, 2023

Merged

[Security] Rename logout’s`csrf_token_generator` to`csrf_token_manager`#17482

OskarStark merged 1 commit intosymfony:6.3fromMatTheCat:logout-csrf-token-generator

Jan 30, 2023

Conversation

Copy link

Contributor

MatTheCat commentedNov 29, 2022•
edited
Loading

Follow-up ofsymfony/symfony#48387

Should I still mention the deprecatedcsrf_token_generator in the documentation? If yes, how?

carsonbot added Status: Needs Review Security labels

Nov 29, 2022

carsonbot added this to the6.2 milestone

Nov 29, 2022

MatTheCat mentioned this pull request

Nov 29, 2022

[SecurityBundle] Renamefirewalls.logout.csrf_token_generator tofirewalls.logout.csrf_token_managersymfony/symfony#48387

Merged

MatTheCat changed the base branch from6.2 to6.3

November 29, 2022 16:08

fabpot added a commit to symfony/symfony that referenced this pull request

Dec 22, 2022

feature#48387[SecurityBundle] Rename `firewalls.logout.csrf_token_g…

9df40aa

…enerator` to `firewalls.logout.csrf_token_manager` (MatTheCat)This PR was merged into the 6.3 branch.Discussion----------[SecurityBundle] Rename `firewalls.logout.csrf_token_generator` to `firewalls.logout.csrf_token_manager`| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | no| New feature?  | no| Deprecations? | yes| Tickets       | N/A| License       | MIT| Doc PR        |symfony/symfony-docs#17482A long time ago,#6554 replaced `CsrfProviderInterface` by `CsrfTokenGeneratorInterface`, and#9216 split the latter into `CsrfTokenManagerInterface` and `TokenGeneratorInterface`.#9587 later introduced `csrf_token_generator`, which was already wrong at the time.Given that token generators exist, it feels weird to have to set <code>csrf_token_**generator**</code> to <code>security.csrf.token_**manager**</code> as mentioned in [the documentation](https://symfony.com/doc/current/reference/configuration/security.html#csrf-token-generator).As this confusion recently led to#48339, I propose to rename `firewalls.logout.csrf_token_generator` to `firewalls.logout.csrf_token_manager`.Commits-------0a0a98a [SecurityBundle] Rename `firewalls.logout.csrf_token_generator` to `firewalls.logout.csrf_token_manager`