Skip to content

[LiveComponent] Disable stateful CSRF protection by default #2250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[LiveComponent] Disable stateful CSRF protection by default #2250

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/LiveComponent/src/Attribute/AsLiveComponent.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ final class AsLiveComponent extends AsTwigComponent
* @param string|null $defaultAction The default action to call when the component is mounted (ie: __invoke)
* @param bool $exposePublicProps Whether to expose every public property as a Twig variable
* @param string $attributesVar The name of the special "attributes" variable in the template
* @param bool $csrf Whether to enable CSRF protection (default: true)
* @param bool $csrf Whether to enable stateful CSRF protection (default: false - stateless CORS-based CSRF protection is always enabled)
* @param string $route The route used to render the component & handle actions (default: ux_live_component)
* @param int $urlReferenceType Which type of URL should be generated for the given route. Use the constants from UrlGeneratorInterface (default: absolute path, e.g. "/dir/file").
*/
Expand All @@ -40,7 +40,7 @@ public function __construct(
private ?string $defaultAction = null,
bool $exposePublicProps = true,
string $attributesVar = 'attributes',
public bool $csrf = true,
public bool $csrf = false,
public string $route = 'ux_live_component',
public string $method = 'post',
public int $urlReferenceType = UrlGeneratorInterface::ABSOLUTE_PATH,
Expand Down
Loading