ux
ux copied to clipboard
[LiveComponent] Invalid CSRF token exceptions are not correctly managed
Scenario
- Enable CSRF in Symfony
- Without being logged in, browse a page with a Symfony form
- Fill the form then submit it
- Go to /login, login normally then go back to the form with your browser and re-submit it
Actual behaviour (without Live component)
- Form error is correctly displayed with HTTP 422 and "Invalid CSRF token" message.
Actual behaviour (with form in a Live component)
- Error 500 is thrown and a popup appears with the exception
Error is thrown here : https://github.com/symfony/ux/blob/d993b1283e32aa190553261e9fda0a3d4e72e0f1/src/LiveComponent/src/EventListener/LiveComponentSubscriber.php#L112-L117
This issue occurs because CSRF are reset on each login/logout (which is normal behaviour) I think we need to find a better way to handle this, since in prod environnements this leads to a 500 error to end users.