symfony/symfony · error · LogicException

CSRF protection is not enabled in your application. Enable i

Error message

CSRF protection is not enabled in your application. Enable it with the "csrf_protection" key in "config/packages/framework.yaml".

What it means

Thrown by ControllerHelper::isCsrfTokenValid() (and the identical AbstractController method) when the security.csrf.token_manager service is absent. CSRF token validation requires symfony/security-csrf and the framework.csrf_protection config to be enabled; otherwise the CsrfTokenManagerInterface service is never registered.

Source

Thrown at src/Symfony/Bundle/FrameworkBundle/Controller/ControllerHelper.php:397

        }

        if (null === $token = $this->container->get('security.token_storage')->getToken()) {
            return null;
        }

        return $token->getUser();
    }

    /**
     * Checks the validity of a CSRF token.
     *
     * @param string      $id    The id used when generating the token
     * @param string|null $token The actual token sent with the request that should be validated
     */
    public function isCsrfTokenValid(string $id, #[\SensitiveParameter] ?string $token): bool
    {
        if (!$this->container->has('security.csrf.token_manager')) {
            throw new \LogicException('CSRF protection is not enabled in your application. Enable it with the "csrf_protection" key in "config/packages/framework.yaml".');
        }

        return $this->container->get('security.csrf.token_manager')->isTokenValid(new CsrfToken($id, $token));
    }

    /**
     * Adds a Link HTTP header to the current response.
     *
     * @see https://tools.ietf.org/html/rfc5988
     */
    public function addLink(Request $request, LinkInterface $link): void
    {
        if (!class_exists(AddLinkHeaderListener::class)) {
            throw new \LogicException('You cannot use the "addLink" method if the WebLink component is not available. Try running "composer require symfony/web-link".');
        }

        if (null === $linkProvider = $request->attributes->get('_links')) {
            $request->attributes->set('_links', new GenericLinkProvider([$link]));

View on GitHub (pinned to 698e28026c)

Solutions

Enable CSRF in config/packages/framework.yaml: framework.csrf_protection: { enabled: true }.
Run `composer require symfony/security-csrf` if the package is missing.
For stateless APIs where CSRF is intentionally disabled, remove the isCsrfTokenValid() call.

Example fix

// before — config/packages/framework.yaml
framework:
    csrf_protection: { enabled: false }
// after
framework:
    csrf_protection: { enabled: true }

Defensive patterns

Strategy: validation

Validate before calling

if ($this->container->has('security.csrf.token_manager')) {
    return $this->isCsrfTokenValid($id, $token);
}
// CSRF disabled — decide whether to skip validation or fail closed

Try / catch

try {
    $valid = $this->isCsrfTokenValid($id, $token);
} catch (\LogicException $e) {
    // CSRF not enabled — fail closed for state-changing actions
    $valid = false;
}

Prevention

Enable framework.csrf_protection whenever forms use CSRF tokens.
Keep CSRF checks on all state-changing form submissions; never silently skip.
Verify security-csrf is installed via composer.lock in CI.

When it happens

Trigger: Calling $this->isCsrfTokenValid('delete-item', $token) in a controller when CSRF protection is disabled in framework.yaml or symfony/security-csrf is not installed.

Common situations: Adding CSRF checks to a form/API endpoint in an app where csrf_protection is off by default, or after disabling it; missing security-csrf package.

Related errors

AI-assisted analysis of symfony/symfony@698e28026c (2026-08-06). Data as JSON: /api/errors/4abf6be7c4ceedf1. Report an issue: GitHub.