如何在 Symfony 2 中跨多种表单实现单个 CSRF 令牌？

Question

... and should I even be attempting this?

I'm using Symfony 2 (just upgraded from 2.3 to 2.5 ) and from my experience the framework leans towards generating a CSRF token per form. This is fine if you have one form per page, but often times you want to have multiple forms on a page, hidden, with one form presenting itself after a user interaction of some kind.

In Java, using the Spring Framework, the CSRF token appears to be associated with the session (and supplied as an attribute on the request).

My two use cases are: (1) supporting multiple forms (of the same type) on the same page using JavaScript driven templates (eg Handlebars ) and (2) having multiple forms (of different types) on the same page also driven by JavaScript templates.

My question is threefold:

1. Is there any way to achieve a CSRF -token per session rather than per form intention? What are the arguments against this?
2. Can this be achieved "out-of-the-box" or would a custom provider need to be written which ignores the intention of a form?
3. Would it be better to serialize the form-type(s) to JSON and maintain the different instances of the CSRF token per form?

---

As an aside, OWASP presents a general recommnedation on this subject:

" In general, developers need only generate this token once for the current session. After initial generation of this token, the value is stored in the session and is utilized for each subsequent request until the session expires. When a request is issued by the end-user, the server-side component must verify the existence and validity of the token in the request as compared to the token found in the session... "

Answer 1

1) csrf tokens are generated per form per session, so if you want to have a csrf token per session you just need to make sure the intention (which is the name of the form by default) is the same for all forms. the problem is that you'll basically open the gates for people to submit one form in place of another as when the form is validated, it will check the csrf and validate as true even though that from is not the one it was looking for.

2) you just really need to make sure you set the intention yourself when you create and validate a form

3)The best way to achieve what you want is to just render each form and use javascript to serialize and submit the forms to separate controller actions. your code will be much cleaner and you'll have fewer security issues.