Automatic CSRF protection for JavaScript apps using Symfony APIs via cookie-header validation.
DunglasAngularCsrfBundle is a Symfony bundle that automatically protects JavaScript applications from Cross-Site Request Forgery (CSRF) attacks when interacting with Symfony-based APIs. It implements a cookie-header validation mechanism where the server sets a CSRF token cookie and validates it against a corresponding HTTP header in subsequent requests. This approach secures API endpoints without requiring developers to manually handle tokens in their application logic.
Symfony developers building APIs consumed by JavaScript frontend applications who need robust CSRF protection with minimal code changes. It's particularly useful for projects using API Platform or FOSRestBundle.
Developers choose this bundle because it provides automatic, configuration-driven CSRF protection that works out-of-the-box with Symfony's event system, supports all major JavaScript frameworks, and integrates seamlessly with Symfony Form Component while requiring zero modifications to application code.
Automatic CSRF protection for JavaScript apps using a Symfony API
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automatically sets a CSRF token cookie on configured routes and validates it via HTTP headers, eliminating manual token management as described in the 'How it Works' section.
Works with any JavaScript framework using XMLHttpRequest or Fetch API, including Angular, React, and Vue.js, ensuring flexibility for client-side apps, as stated in the README.
Allows fine-grained control over URL patterns, HTTP methods, and hosts for setting cookies and securing endpoints, demonstrated in the YAML configuration examples.
Seamlessly disables Symfony Form Component's built-in CSRF protection when a valid token is provided via header, preventing duplicate validation efforts, as noted in the integration section.
The project is marked as archived and not necessary for most modern applications, meaning no updates or security patches, which poses a risk for long-term use.
Requires detailed YAML configuration for patterns, methods, and hosts, which can be cumbersome and error-prone for developers unfamiliar with the bundle's syntax.
Exclusively designed for Symfony, making it unsuitable for projects using other PHP frameworks or non-PHP backends, creating vendor lock-in.