CSRF Token handling not longer working in Symfony 5.4

[alexander-schranz]

Q	A
Bug?	no
New Feature?	no
Symfony Version	>= 5.4.0
Bundle Version	2.2.1
Sulu Version	2.3.5
Browser Version	all

Actual Behavior

CSRF Token handling not longer working in Symfony 5.4. When visiting a site with a CSRF Token. No SessionID Cookie is written.

Expected Behavior

CSRF Token should be loaded and correctly used.

Proposed Solution

Maybe we can analyse how the ESI Content is set to the Cached content and forward the Set-Cookie from the subrequest to the main request. This is something which will only work for Symfony Http Cache.

Workarounds

Workaround A: Downgrade symfony/http-kernel:

composer require "symfony/http-kernel:5.3.*“ --no-update
composer update

Workaround B:

Implement Ajax behaviour for symfony http kernel:

https://github.com/sulu/SuluFormBundle/blob/2.x/Resources/doc/csrf.md#ajax

Workaround C:

Using recaptcha currently disable csrf token for forms.

https://github.com/sulu/SuluFormBundle/blob/2.x/Resources/doc/recaptcha.md

[benjamintypzwo]

I got hit by this issue too.

Composer won't let me dowgrade, complains it can't find a suitable set of dependencies to install.

Is there any other suggestion for a workaround?

[alexander-schranz]

@benjamintypzwo see Alternative B in the Description for another workaround.

[benjamintypzwo]

Ah I see, sorry - totally misunderstood this one.
Thank you.

[alexander-schranz]

@benjamintypzwo added additional workaround. when you enable recaptcha for your form it currently disables csrf token checks and so can be used as an alternative workaround.

[alexander-schranz]

At current state we will disable csrf protection by default, so the form bundle just works out of the box. If somebody want csrf protection it need to be enabled and the ajax loading be implemented: https://github.com/sulu/SuluFormBundle/blob/2.4/UPGRADE.md#240. Alternative there can be recaptcha or honeypot fields be used.

[alexander-schranz]

Closing this as we the Symfony HttpCache ESIs behave now similar as Varnish ESIs which make sense so we are not able to fix here and just need to remove the docs about CSRF ESI handling in future when drop support for Symfony 5.3