{"record":{"id":"8eb87d9d3dbe6d53","repo":"symfony/symfony","slug":"unable-to-logout-with-csrf-token-validation-eithe","errorCode":null,"errorMessage":"Unable to logout with CSRF token validation. Either make sure that CSRF protection is enabled and \"logout\" is configured on the \"%s\" firewall, or bypass CSRF token validation explicitly by passing false to the $validateCsrfToken argument of this method.","messagePattern":"Unable to logout with CSRF token validation\\. Either make sure that CSRF protection is enabled and \"logout\" is configured on the \"(.+?)\" firewall, or bypass CSRF token validation explicitly by passing false to the \\$validateCsrfToken argument of this method\\.","errorType":"exception","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/SecurityBundle/Security.php","lineNumber":218,"sourceCode":"        $request = $this->container->get('request_stack')->getMainRequest();\n        if (null === $request) {\n            throw new LogicException('Unable to logout without a request context.');\n        }\n\n        /** @var TokenStorageInterface $tokenStorage */\n        $tokenStorage = $this->container->get('security.token_storage');\n\n        if (!($token = $tokenStorage->getToken()) || !$token->getUser()) {\n            throw new LogicException('Unable to logout as there is no logged-in user.');\n        }\n\n        if (!$firewallConfig = $this->container->get('security.firewall.map')->getFirewallConfig($request)) {\n            throw new LogicException('Unable to logout as the request is not behind a firewall.');\n        }\n\n        if ($validateCsrfToken) {\n            if (!$this->container->has('security.csrf.token_manager') || !$logoutConfig = $firewallConfig->getLogout()) {\n                throw new LogicException(\\sprintf('Unable to logout with CSRF token validation. Either make sure that CSRF protection is enabled and \"logout\" is configured on the \"%s\" firewall, or bypass CSRF token validation explicitly by passing false to the $validateCsrfToken argument of this method.', $firewallConfig->getName()));\n            }\n            $csrfToken = ParameterBagUtils::getRequestParameterValue($request, $logoutConfig['csrf_parameter']);\n            if (!\\is_string($csrfToken) || !$this->container->get('security.csrf.token_manager')->isTokenValid(new CsrfToken($logoutConfig['csrf_token_id'], $csrfToken))) {\n                throw new LogoutException('Invalid CSRF token.');\n            }\n        }\n\n        $logoutEvent = new LogoutEvent($request, $token);\n        $this->container->get('security.firewall.event_dispatcher_locator')->get($firewallConfig->getName())->dispatch($logoutEvent);\n\n        $tokenStorage->setToken(null);\n\n        return $logoutEvent->getResponse();\n    }\n\n    private function getAuthenticator(?string $authenticatorName, string $firewallName): AuthenticatorInterface\n    {\n        if (!isset($this->authenticators[$firewallName])) {","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/SecurityBundle/Security.php#L200-L236","documentation":"Thrown by `Security::logout($validateCsrfToken = true)` when CSRF validation is requested but either the CSRF token manager service is not registered (CSRF component disabled) or the current firewall has no `logout` config. Logout-with-CSRF needs both to read and validate the configured CSRF parameter/token id.","triggerScenarios":"Calling `$security->logout()` with the default `$validateCsrfToken = true` on a firewall that has no `logout` block, or in an environment where `security.csrf.token_manager` is unavailable (CSRF disabled). Line 217 checks `has('security.csrf.token_manager')` and `$firewallConfig->getLogout()`.","commonSituations":"Stateless/API firewalls where logout isn't configured but a controller still calls `logout()`. Disabling CSRF protection globally in tests. Copying a logout call to a new firewall without configuring the `logout` key.","solutions":["Configure a `logout` block on the firewall and ensure the CSRF component is enabled (`symfony/security-csrf` installed and `framework.csrf.enabled: true`).","If CSRF is intentionally off, call `$security->logout(false)` to bypass CSRF validation explicitly.","Install the CSRF package: `composer require symfony/security-csrf`."],"exampleFix":"// before\n$security->logout();\n// after\n$security->logout(false); // bypass CSRF explicitly","handlingStrategy":"validation","validationCode":"// Only enforce CSRF when the prerequisites exist:\n$fw = $security->getFirewallConfig($request);\n$csrfAvailable = $container->has('security.csrf.token_manager');\n$logoutConfigured = null !== $fw?->getLogout();\n$security->logout($csrfAvailable && $logoutConfigured);","typeGuard":null,"tryCatchPattern":"try {\n    $security->logout(); // CSRF on\n} catch (\\Symfony\\Component\\Security\\Core\\Exception\\LogicException $e) {\n    if (str_contains($e->getMessage(), 'CSRF token validation')) {\n        $security->logout(false); // bypass explicitly\n    } else { throw $e; }\n}","preventionTips":["Configure a logout block and enable CSRF on any firewall that calls logout().","In stateless/API contexts, call logout(false) deliberately.","Install symfony/security-csrf where CSRF logout is wanted."],"tags":["security","runtime","csrf","logout","configuration"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}