ux icon indicating copy to clipboard operation
ux copied to clipboard

[LiveComponent] Invalid CSRF token exceptions are not correctly managed

Open simondaigre opened this issue 1 year ago • 12 comments

Scenario

  • Enable CSRF in Symfony
  • Without being logged in, browse a page with a Symfony form
  • Fill the form then submit it
  • Go to /login, login normally then go back to the form with your browser and re-submit it

Actual behaviour (without Live component)

  • Form error is correctly displayed with HTTP 422 and "Invalid CSRF token" message.

Actual behaviour (with form in a Live component)

  • Error 500 is thrown and a popup appears with the exception

Error is thrown here : https://github.com/symfony/ux/blob/d993b1283e32aa190553261e9fda0a3d4e72e0f1/src/LiveComponent/src/EventListener/LiveComponentSubscriber.php#L112-L117

This issue occurs because CSRF are reset on each login/logout (which is normal behaviour) I think we need to find a better way to handle this, since in prod environnements this leads to a 500 error to end users.

simondaigre avatar Sep 28 '23 13:09 simondaigre