Do not disable CSRF protection

Documentos > Code Analysis > Static Analysis Rules > Do not disable CSRF protection

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: php-security/symfony-csrf-disabled

Language: PHP

Severity: Error

Category: Security

CWE: 352

Description

CSRF (Cross-Site Request Forgery) is an attack that tricks the victim into submitting a malicious request. It uses the identity and privileges of the victim to perform an undesired function on their behalf.

Disabling CSRF protection exposes your application to such attacks, compromising user data and potentially leading to unauthorized actions. For instance, an attacker could forge a request to change the email address on record for the victim’s account, effectively hijacking the account.

To avoid violating this rule, ensure that ‘csrf_protection’ is set to true in your PHP code.

Non-Compliant Code Examples

<?php
class Foo
{
  public function configureOptions(OptionsResolver $resolver)
  {
    $resolver->setDefaults([
      'data_class'      => Type::class,
      'csrf_protection' => false
    ]);
    $resolver->setDefaults(array(
      'csrf_protection' => false
    ));
  }
}

class Bar extends Extension implements PrependExtensionInterface
{
  public function prepend(ContainerBuilder $container)
  {
    $container->prependExtensionConfig('framework', ['csrf_protection' => false]);
    $container->loadFromExtension('framework', ['csrf_protection' => false]);
  }
}

class Baz extends AbstractController
{
  public function action()
  {
    $this->createForm(TaskType::class, $task, array(
      'csrf_protection' => false,
    ));
  }
}

Compliant Code Examples

<?php
class Foo
{
  public function configureOptions(OptionsResolver $resolver)
  {
    $resolver->setDefaults([
      'data_class'      => Type::class,
      'csrf_protection' => true,
    ]);
    $resolver->setDefaults(array(
      'csrf_protection' => true,
    ));
  }
}

class Bar extends Extension implements PrependExtensionInterface
{
  public function prepend(ContainerBuilder $container)
  {
    $container->prependExtensionConfig('framework', ['csrf_protection' => true]);
    $container->loadFromExtension('framework', ['csrf_protection' => true]);
  }
}

class Baz extends AbstractController
{
  public function action()
  {
    $this->createForm(TaskType::class, $task, array(
      'csrf_protection' => true,
    ));
  }
}