在特定防火墙上禁用CSRF

Question

I have application which allows user access by 2 different channels.

• normal with twig
• RESTFull through FOSRestBundle - example.com/api/* address

I have enabled CSRF protection, because I want to use it in first case.

framework:
    csrf_protection: true

But... I need to disable CSRF protection while I'm sending request to /api/* addresses, because in this case I'm logging with OAuth.

Can I disable CSRF protection for specific firewall?

My firewalls:

firewalls:
    oauth_token:                                   
        pattern: ^/api/oauth/v2/token
        security: false
    api:
        pattern: ^/api/                            
        fos_oauth: true                            
        stateless: true                            
        anonymous: false                           
    main:
        pattern: ^/
        form_login:
            provider: chain_provider
            csrf_provider: form.csrf_provider
        logout:       true
        anonymous:    true

While I'm sending POST requests to /api/ server returns error:

The CSRF token is invalid. Please try to resubmit the form.

I need to disable this protection for api firewall and keep it for main . Is it possible?

Answer 1

You can handle this on user basis:

http://symfony.com/doc/current/bundles/FOSRestBundle/2-the-view-layer.html#csrf-validation

When building a single application that should handle forms both via HTML forms as well as via a REST API, one runs into a problem with CSRF token validation. In most cases it is necessary to enable them for HTML forms, but it makes no sense to use them for a REST API. For this reason there is a form extension to disable CSRF validation for users with a specific role. This of course requires that REST API users authenticate themselves and get a special role assigned.

 fos_rest: disable_csrf_role: ROLE_API