https://github.com/dneustadt/DneustadtCsrfCookieBundle/blob/2640428b643c4306641e8e9e1b92e9fce2ab9ec2/Service/CsrfRequestEvaluator.php#L102-L110

headers->cookieHeader : cookies->cookieHeader

This doesn't seem correct.

I have - according to the README - a default route config that says XSRF-TOKEN for cookie-name, and X-XSRF-TOKEN for header name.

On a request, I receive the cookie XSRF-TOKEN. But if I make another request with that cookie, the CSRF is still invalid. However, if I send another request with a cookie with the name X-XSRF-TOKEN it works... !?

Also, by copying the value from the XSRF-TOKEN cookie and specifying it in a 'X-XSRF-TOKEN' header, it works. But this means copying the cookie to a header, which means accessing it from JavaScript which means no 'cookie.httponly'.

Also, when I reply with a cookie with X-XSRF-TOKEN I now receive three cookies. The session-cookie, a XSRF-TOKEN cookie and a X-XSRF-TOKEN cookie. Something is acting up :).

Quick fix for me is to alter the default-route config to set both 'headername' and 'cookiename' to XSRF-TOKEN. Now, when I receive a cookie XSRF-TOKEN it works when I reply with that exact same cookie.

Which means on JavaScript-side I don't have to code anything, cookies are handled by the browser, and now the cookie-settings can be set back to 'httponly' and 'secure' as it should be.

Hello there! This is my first issue. We are developing an API for a mobile app and we are working in the json_login with symfony 5.1.5 and we have implemented this bundle to give CSRF Protection to the app. The problem is that we have to make two requests to the json_login route to get XSRF Cookie and log in. Is there anyway to solve this problem???? I enclose a screenshot of my code `/** * @Route("/json_login", name="json_login", methods={"POST"}, defaults={"csrf": {"create": true}}) * @param IriConverterInterface $iriConverter * @param TokenStorageInterface $tokenStorage * @param Request $request * @return Response */ public function jsonLoginAction(IriConverterInterface $iriConverter, TokenStorageInterface $tokenStorage, Request $request) {

    if(!$this->isGranted('IS_AUTHENTICATED_FULLY')) {
        return $this->json([
            'error' => 'Invalid Request!!!'
        ], 400);
    }


     $response = $this->json([
        'user' => $iriConverter->getIriFromItem($this->getUser())
    ]);

    return new JsonResponse($response->getContent(), 201);
}

` That's my json_login code

dneustadt_csrf_cookie: Generally enable/disable the CSRF protection enable: true ID used to generate token id: csrf Name of the cookie the token is stored in name: XSRF-TOKEN Cookie expiration expire: 0 Cookie path path: / Cookie domain domain: ***************** Cookie secure secure: false Name of the HTTP header the token is expected to be stored in header: X-XSRF-TOKEN Cookie same site policy sameSite: lax

And that's my configuration

I was getting empty cookie as the code was accessing request header in vendor/dneustadt/csrf-cookie-bundle/CsrfRequestEvaluator.php public function isTokenValid(Request $request, bool $throwException = true): bool { $token = $request->header->get($this->cookieHeader);

    if (empty($token)) {
        if ($throwException === false) {
            return false;
        }

        throw new AccessDeniedHttpException('The CSRF token is invalid empty Please try to resubmit the form.');
    }

I changed $request->header to $request->cookies and the issue is fixed public function isTokenValid(Request $request, bool $throwException = true): bool { $token = $request->cookies->get($this->cookieHeader);

    if (empty($token)) {
        if ($throwException === false) {
            return false;
        }

        throw new AccessDeniedHttpException('The CSRF token is invalid empty Please try to resubmit the form.');
    }

Hello Team,

nice to see this bundle. I was trying to replace dunglas/angular-csrf-bundle with your bundle. I see the dunglas bundle refreshed csrf token only when it expired. Otherwise, it uses the same token for the next request too. Is it possible to have an option to be added to create only token, when it expired instead of creating a token every time when we hit the set token url?

Thanks, Arun Varghese

Hello, first i would like to thank you so much for providing this package

it seems like this package is only for symfony ^5.x when i tried to install via composer i got this message:

Problem 1
    - Root composer.json requires dneustadt/csrf-cookie-bundle ^1.0 -> satisfiable by dneustadt/csrf-cookie-bundle[1.0.0, 1.0.1, 1.0.2, 1.0.3].
    - dneustadt/csrf-cookie-bundle[1.0.0, ..., 1.0.3] require symfony/config ^5.0 -> found symfony/config[v5.0.0, ..., v5.4.9] but the package is fixed to v6.1.0 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.

BR

This PR adds compatibility with Symfony 4.4. It also lowers the PHP requirement from 7.2.5 to 7.1.3 to match Symfony 4.4's minimum. Also added the symfony and bundle keywords in composer.json; of course, they're not necessary, it's just a bit of SEO for the bundle.

On a side note, I think the bundle could easily also be compatible with Symfony 4.2 (that's when Symfony started handling the SameSite cookie attribute), although I don't see a point since Symfony 4.2 and 4.3 are already unmaintained. Symfony 4.4 is going to be maintained until November 2023.