[Security] Add support for dynamic CSRF id with Expression in #[IsCsrfTokenValid]

[alamirault]

Fix #19753

[rcsofttech85]

you may consider changing your code to this...

    #[IsCsrfTokenValid(new Expression('"delete-item-" ~ args["post"].id'), tokenKey: 'token')]
    public function delete(Post $post): Response
    {
        // ... do something, like deleting an object
    }

post argument is mandatory in this case

[alamirault]

You're right, updated

[OskarStark]

Thank you Antoine.

[yguedidi]

Thank you @alamirault