{"record":{"id":"4abf6be7c4ceedf1","repo":"symfony/symfony","slug":"csrf-protection-is-not-enabled-in-your-application-4abf6b","errorCode":null,"errorMessage":"CSRF protection is not enabled in your application. Enable it with the \"csrf_protection\" key in \"config/packages/framework.yaml\".","messagePattern":"CSRF protection is not enabled in your application\\. Enable it with the \"csrf_protection\" key in \"config/packages/framework\\.yaml\"\\.","errorType":"http","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/FrameworkBundle/Controller/ControllerHelper.php","lineNumber":397,"sourceCode":"        }\n\n        if (null === $token = $this->container->get('security.token_storage')->getToken()) {\n            return null;\n        }\n\n        return $token->getUser();\n    }\n\n    /**\n     * Checks the validity of a CSRF token.\n     *\n     * @param string      $id    The id used when generating the token\n     * @param string|null $token The actual token sent with the request that should be validated\n     */\n    public function isCsrfTokenValid(string $id, #[\\SensitiveParameter] ?string $token): bool\n    {\n        if (!$this->container->has('security.csrf.token_manager')) {\n            throw new \\LogicException('CSRF protection is not enabled in your application. Enable it with the \"csrf_protection\" key in \"config/packages/framework.yaml\".');\n        }\n\n        return $this->container->get('security.csrf.token_manager')->isTokenValid(new CsrfToken($id, $token));\n    }\n\n    /**\n     * Adds a Link HTTP header to the current response.\n     *\n     * @see https://tools.ietf.org/html/rfc5988\n     */\n    public function addLink(Request $request, LinkInterface $link): void\n    {\n        if (!class_exists(AddLinkHeaderListener::class)) {\n            throw new \\LogicException('You cannot use the \"addLink\" method if the WebLink component is not available. Try running \"composer require symfony/web-link\".');\n        }\n\n        if (null === $linkProvider = $request->attributes->get('_links')) {\n            $request->attributes->set('_links', new GenericLinkProvider([$link]));","sourceCodeStart":379,"sourceCodeEnd":415,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/FrameworkBundle/Controller/ControllerHelper.php#L379-L415","documentation":"Thrown by ControllerHelper::isCsrfTokenValid() (and the identical AbstractController method) when the security.csrf.token_manager service is absent. CSRF token validation requires symfony/security-csrf and the framework.csrf_protection config to be enabled; otherwise the CsrfTokenManagerInterface service is never registered.","triggerScenarios":"Calling $this->isCsrfTokenValid('delete-item', $token) in a controller when CSRF protection is disabled in framework.yaml or symfony/security-csrf is not installed.","commonSituations":"Adding CSRF checks to a form/API endpoint in an app where csrf_protection is off by default, or after disabling it; missing security-csrf package.","solutions":["Enable CSRF in config/packages/framework.yaml: framework.csrf_protection: { enabled: true }.","Run `composer require symfony/security-csrf` if the package is missing.","For stateless APIs where CSRF is intentionally disabled, remove the isCsrfTokenValid() call."],"exampleFix":"// before — config/packages/framework.yaml\nframework:\n    csrf_protection: { enabled: false }\n// after\nframework:\n    csrf_protection: { enabled: true }","handlingStrategy":"validation","validationCode":"if ($this->container->has('security.csrf.token_manager')) {\n    return $this->isCsrfTokenValid($id, $token);\n}\n// CSRF disabled — decide whether to skip validation or fail closed","typeGuard":null,"tryCatchPattern":"try {\n    $valid = $this->isCsrfTokenValid($id, $token);\n} catch (\\LogicException $e) {\n    // CSRF not enabled — fail closed for state-changing actions\n    $valid = false;\n}","preventionTips":["Enable framework.csrf_protection whenever forms use CSRF tokens.","Keep CSRF checks on all state-changing form submissions; never silently skip.","Verify security-csrf is installed via composer.lock in CI."],"tags":["security","csrf","controller","configuration"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}