I have a question regarding the handling of CSRF errors. By default, a CSRF error will result in a very basic / generic error screen. This is problematic for CSRF-protected forms since it interupts the user flow and gives no way to recover from the error. Of course, one can create a 400.twig template which is used when a HTTP 400 error occurs. But what I really want is a way to handle those errors more gracefully – for example, reloading the form (with the previous input intact) and informing the user about the error. The only way I can think of is to disable the CSRF protection (inside a controller with $enableCsrfValidation = false) to prevent the request form bailing out before it reaches the controller, then perform the CSRF check manually and handle errors accordingly. But is there a simpler way?

What if it's not your own controller but a controller from a plugin? I'm using the Contact Form plugin which uses the CSRF protection. Is there a way for a user of that module to handle failed CSRF checks for requests to that plugins contact-form/send endpoint in the same way as all other input errors? That is, reload the form with all inputs intact and an appropriate error message? Or can this only be achieved from inside the module itself using the method described above?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.