document old way of checking validity of CSRF token

[snoek09]

Q	A
Doc fix?	yes
New docs?	yes
Applies to	all
Fixed tickets	Related to #4668

[xabbuh]

👍

[OskarStark]

DELETE in backticks?

[snoek09]

I checked the docs for mentions of HTTP methods. In a sentence they are never in backticks.

[OskarStark]

👍

[snoek09]

@xabbuh please let me know if the example code is fine now.

[snoek09]

@xabbuh is this PR finished?

[xabbuh]

I think this should link to the method in the interface instead (it doesn't matter which implementation is registered as the service).

[xabbuh]

@snoek09 Sorry for missing your last comment. I left a last minor comment. After that this looks good to be merged to me.

[snoek09]

@xabbuh No problem. I updated the link.

[OskarStark]

👍

[snoek09]

@xabbuh I think this is ready to be merged.

[xabbuh]

@weaverryan @wouterj @javiereguiluz Ready to go here? :)

[weaverryan]

Does it make sense to show this without showing a template? When you generate the CSRF token in the template, you would need to also include authenticate then, right?

[weaverryan]

I added some comments, but I like it! Short and simple.

To be clear, this is not an "old way" of checking CSRF, correct? It seems totally valid and current.

Thanks!

[ogizanagi]

@weaverryan : No it isn't, because the form.csrf_provider service is deprecated since 2.4, as well as the whole CsrfProviderInterface. We use security.csrf.token_manager instead.

However, I wonder if the book/controller.rst page is the right place for this ? In #4668, @wouterj suggested to create a new entry in the cookbook instead, and to me it actually makes much more sense to have this in a Controller or Security cookbook section.
I know PRs for 2.6+ are already merged (#5325), but what do you think ?

[snoek09]

@ogizanagi is right. The example code has to work with 2.3 using the 'old way'.
I also agree that this documentation should be moved to the cookbook.

[xabbuh]

I think we can merge it just as it is and then work on converting this into a cookbook recipe afterwards. What do you think?

[ogizanagi]

👍

[snoek09]

I like that idea @xabbuh.

[xabbuh]

@weaverryan @wouterj @javiereguiluz Okay with merging and thinking about how to rework the whole part afterwards?

[javiereguiluz]

@xabbuh yes!

[weaverryan]

👍

[xabbuh]

Thank you Henry.