Mar 23, 2018 · Mar 25, 2018 · Mar 23, 2018 · Mar 25, 2018
diff --git a/security/csrf.rst b/security/csrf.rst
 value that only you and your user know. This ensures that the user - not some
 other entity - is submitting the given data.

 Before using the CSRF protection, install it in your project (which in turn
 requires installing the Symfony Form component):
 Before using the CSRF protection, install it in your project:

 .. code-block:: terminal

    $ composer require security-csrf form
    $ composer require security-csrf

 Then, enable/disable the CSRF protection with the ``csrf_protection`` option
 (see the :ref:`CSRF configuration reference <reference-framework-csrf-protection>`
 CSRF Protection in HTML Forms
 -----------------------------

 .. versionadded:: 4.1
    In Symfony versions prior to 4.1, CSRF support required installing the
    Symfony Form component even if you didn't use it.

 It's also possible to add CSRF protection to regular HTML forms not managed by
 the Symfony Form component, for example the simple forms used to delete items.
 First, use the ``csrf_token()`` function in the Twig template to generate a CSRF
Original file line number	Diff line number	Diff line change
Expand Up		@@ -12,12 +12,11 @@ CSRF protection works by adding a hidden field to your form that contains a
		value that only you and your user know. This ensures that the user - not some
		other entity - is submitting the given data.

		Before using the CSRF protection, install it in your project (which in turn
		requires installing the Symfony Form component):
		Before using the CSRF protection, install it in your project:

		.. code-block:: terminal

		$ composer require security-csrf form
		$ composer require security-csrf
Copy link Member xabbuhMar 23, 2018 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Do we now need to show how to install forms for the section where we integrate CSRF tokens into a Symfony form? Or is it too obvious that you do of course need the Form component for them? Copy link MemberAuthor javiereguiluzMar 25, 2018 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I agree with you that it would be too obvious to install`form` first because you are literally creating a Symfony Form in that section.

		Then, enable/disable the CSRF protection with the ``csrf_protection`` option
		(see the :ref:`CSRF configuration reference <reference-framework-csrf-protection>`
Expand DownExpand Up		@@ -278,6 +277,10 @@ After this, you have protected your login form against CSRF attacks.
		CSRF Protection in HTML Forms
		-----------------------------

		.. versionadded:: 4.1
		In Symfony versions prior to 4.1, CSRF support required installing the
		Symfony Form component even if you didn't use it.

		It's also possible to add CSRF protection to regular HTML forms not managed by
		the Symfony Form component, for example the simple forms used to delete items.
		First, use the ``csrf_token()`` function in the Twig template to generate a CSRF
Expand Down