{"record":{"id":"fa8ca3f44d35bd4d","repo":"symfony/symfony","slug":"to-use-form-csrf-protection-framework-csrf-prote","errorCode":null,"errorMessage":"To use form CSRF protection, \"framework.csrf_protection\" must be enabled.","messagePattern":"To use form CSRF protection, \"framework\\.csrf_protection\" must be enabled\\.","errorType":"exception","errorClass":"LogicException","httpStatus":null,"severity":"error","filePath":"src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php","lineNumber":830,"sourceCode":"        return class_exists(Application::class);\n    }\n\n    private function registerFormConfiguration(array $config, ContainerBuilder $container, PhpFileLoader $loader): void\n    {\n        $loader->load('form.php');\n\n        if (!property_exists(ValidatorExtension::class, 'violationMapper')) {\n            $container->removeDefinition('form.violation_mapper');\n            $container->removeAlias(ViolationMapperInterface::class);\n            $container->getDefinition('form.type_extension.form.validator')->replaceArgument(1, false);\n        }\n        if (null === $config['form']['csrf_protection']['enabled']) {\n            $this->writeConfigEnabled('form.csrf_protection', $config['csrf_protection']['enabled'], $config['form']['csrf_protection']);\n        }\n\n        if ($this->readConfigEnabled('form.csrf_protection', $container, $config['form']['csrf_protection'])) {\n            if (!$container->hasDefinition('security.csrf.token_generator')) {\n                throw new \\LogicException('To use form CSRF protection, \"framework.csrf_protection\" must be enabled.');\n            }\n\n            $loader->load('form_csrf.php');\n\n            $container->setParameter('form.type_extension.csrf.enabled', true);\n            $container->setParameter('form.type_extension.csrf.field_name', $config['form']['csrf_protection']['field_name']);\n            $container->setParameter('form.type_extension.csrf.field_attr', $config['form']['csrf_protection']['field_attr']);\n            $container->setParameter('.form.type_extension.csrf.token_id', $config['form']['csrf_protection']['token_id']);\n        } else {\n            $container->setParameter('form.type_extension.csrf.enabled', false);\n        }\n\n        if (!ContainerBuilder::willBeAvailable('symfony/translation', Translator::class, ['symfony/framework-bundle', 'symfony/form'])) {\n            $container->removeDefinition('form.type_extension.upload.validator');\n        }\n    }\n\n    private function registerHttpCacheConfiguration(array $config, ContainerBuilder $container, bool $httpMethodOverride, ?array $allowedHttpMethodOverride): void","sourceCodeStart":812,"sourceCodeEnd":848,"githubUrl":"https://github.com/symfony/symfony/blob/698e28026c22cf35d032cdb6e800db48b1535790/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php#L812-L848","documentation":"Thrown during form configuration registration when form-level CSRF protection (form.csrf_protection.enabled) is turned on but the global CSRF protection (framework.csrf_protection) is not enabled, meaning the 'security.csrf.token_generator' container definition is absent. Symfony's form CSRF extension depends on the token generator service which is only registered when global CSRF protection is active. The check is at FrameworkExtension.php:828-830.","triggerScenarios":"Configuring 'framework.form.csrf_protection.enabled: true' while 'framework.csrf_protection.enabled' is false or unset. The readConfigEnabled() call at line 828 returns true for form CSRF, but $container->hasDefinition('security.csrf.token_generator') at line 829 returns false.","commonSituations":"Developer enables form CSRF in a bundle config or via a config override without enabling the global CSRF protection. Or during a security audit hardening pass where form CSRF was turned on but the base CSRF service wasn't installed/enabled. Also common when symfony/security-csrf is not installed.","solutions":["Enable global CSRF protection: set 'framework.csrf_protection.enabled: true' in config/packages/framework.yaml.","Ensure symfony/security-csrf is installed: composer require symfony/security-csrf.","If you intentionally don't want form CSRF, set 'framework.form.csrf_protection.enabled: false' to disable it explicitly."],"exampleFix":"# before\nframework:\n    form:\n        csrf_protection:\n            enabled: true\n    # csrf_protection not set → defaults to not enabled\n\n# after\nframework:\n    csrf_protection:\n        enabled: true\n    form:\n        csrf_protection:\n            enabled: true","handlingStrategy":"validation","validationCode":"// Validate config consistency before deploy\n$csrfEnabled = $config['framework']['csrf_protection']['enabled'] ?? false;\n$formCsrfEnabled = $config['framework']['form']['csrf_protection']['enabled'] ?? false;\nif ($formCsrfEnabled && !$csrfEnabled) {\n    throw new \\LogicException('form.csrf_protection requires framework.csrf_protection to be enabled.');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always enable framework.csrf_protection when enabling form.csrf_protection.","Run 'php bin/console config:dump framework' to verify CSRF config resolution.","Ensure symfony/security-csrf is installed when CSRF is enabled."],"tags":["configuration","csrf","forms","security","symfony"],"analyzedSha":"698e28026c22cf35d032cdb6e800db48b1535790","analyzedAt":"2026-08-06T23:40:49.025Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}