如果表单仅包含提交按钮，Symfony3 CSRF错误

Question

Introduction

I am using Symfony v3.4

I am trying to delete an item of goods from database. In order to do so i am using approach described here .

In short - it is possible to use two form submit buttons to decide - either: delete an item or return to list (by redirect). After checking form validity it is possible to know which button was pressed so it suites the needs. (This approach does not rely on JavaScript).

For the purpose i created form with 2 differently named submit buttons (with no additional fields). I create the form in controller and pass it to the view, it displays as expected.

Problem

Problem is - when i submit form it is not valid! The error is: The CSRF token is invalid. Please try to resubmit the form. The CSRF token is invalid. Please try to resubmit the form. Resubmitting does not change a thing, form remains not valid...

I thought that Symfony Forms automatically handles CSRF token! Does it not in this case? What am i missing?

Question

What is the best practice in this situation?

Profiler screen shot

Code

my FormType

namespace AppBundle\Form\Type;

use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\Extension\Core\Type\SubmitType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolver;

class ReservationActionType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options)
    {
        $builder
            ->add('delete', SubmitType::class, array(
                'attr' => array('class' => 'btn btn-danger'),
                'label' => 'Yes, delete an item'
            ))
            ->add('return', SubmitType::class, array(
                'attr' => array('class' => 'btn btn-default'),
                'label' => 'No, return to list'
            ));
        ;
    }

    public function configureOptions(OptionsResolver $resolver)
    {
        $resolver->setDefaults(
            array(
                'csrf_protection' => true,
                'csrf_field_name' => '_token',
            )
        );
    }
}

my Controller

public function reservationDelete($reservation_id = 0, Request $request)
{
    // get $reservation that corresponds $reservation_id from database

    $form = $this->createForm(ReservationActionType::class);

    $form->handleRequest($request);

    if ($form->isSubmitted() && $form->isValid())
    {
        if ($form->get('delete')->isClicked())
        {
            dump('replace this with item delete code');
        }
        else if ($form->get('return')->isClicked())
        {
            return $this->redirectToRoute('admin_reservations');
        }
    }

    return $this->render('admin/reservations_use_code.html.twig',
        [
            'reservation_id' => $reservation_id,
            'reservation' => $reservation,
            'form' => $form->createView()
        ]
    );
}

my template part where form resides

{% if reservation['id'] is defined %}
    {{ form_start(form, {'attr': {'novalidate': 'novalidate', 'method': 'POST'}}) }}
        {{ form_widget(form.delete) }}
        {{ form_widget(form.return) }}
    {{ form_end(form) }}
{% endif %}

Answer 1

Try to add the CSRF in your form directly :

   ...
   {{ form_row(form._token) }}
{{ form_end(form) }}

Answer 2

Actually, yes it can!

(With the small difference that rendering forms this way is specific to Twig, rather than Symfony)

But the way you render your form, you are actually (by mistake I guess) saying twig not to render other fields than "delete" and "return". This is why your CSRF token is not found.

Instead of rendering your fields manually, I would suggest you to use a theme ( https://symfony.com/doc/3.4/form/form_customization.html ) to customize your specific rows and fields.

Then you can just render your form in the following ways :

{{ form(form) }}

To surcharge the form itself, rendering all fields automatically (including CSRF) : notice the difference between form_widget(form) (render all fields) and form_widget(form.my_field) (render "my_field" only)

{{ form_start(form, { attr: { novalidate: true }}) }}
    {{ form_widget(form) }}
{{ form_end(form) }}

To surcharge a specific field without using theme (a bit heavier to write IMO), use form_rest(form) to render all the other fields (including CSRF)

{{ form_start(form) }}
    {{ form_row(form.delete, { attr: { class: 'whatever' }}) }}
    {{ form_rest(form) }}
{{ form_end(form) }}