Keep Symfony CSRF enabled on state-changing form flows

#Metadata

Rule ID

php.security.symfony-csrf-disabled

Severity

high

Confidence

0.84

Languages

php

Presets

security, strict

Stability

stable

Applies to

block

Tags

csrf, php, rules-catalog, security, symfony

#Why it matters

Disabling CSRF for authenticated browser flows enables cross-site request forgery on sensitive actions.

#Remediation

Keep CSRF enabled for browser forms/controllers and only exempt endpoints that are explicitly authenticated by signed tokens.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/php/php.security.symfony-csrf-disabled.rule.yaml.