[Security] Decouple CSRF component from security-core #42148

javiereguiluz · 2021-07-16T09:37:03Z

symfony/security-csrf is installable as a stand-alone package. However, it requires security-core:

symfony/src/Symfony/Component/Security/Csrf/composer.json

Lines 18 to 21 in 27aceb6

    
           "require": { 
        
               "php": ">=7.2.5", 
        
               "symfony/security-core": "^4.4|^5.0|^6.0" 
        
           },

I use CSRF in some forms not related to Security, so I want CSRF but I don't want the entire Security package. Why is this important to me?

Because symfony/security-csrf is a tiny 18-file and 0.06 MB on disk package, whereas symfony/security-core is a big 258-file and 1.1 MB on disk package.

Moreover, although CSRF requires the entire Security package, it only uses two tiny exception classes from it:

Here:

symfony/src/Symfony/Component/Security/Csrf/CsrfTokenManager.php

Line 15 in 27aceb6

use Symfony\Component\Security\Core\Exception\InvalidArgumentException;

And here:

symfony/src/Symfony/Component/Security/Csrf/Exception/TokenNotFoundException.php

Line 14 in 27aceb6

use Symfony\Component\Security\Core\Exception\RuntimeException;

So maybe we can decouple these packages? Thanks!

The text was updated successfully, but these errors were encountered:

wouterj · 2021-07-16T12:24:12Z

See #36423 The conclusion was: "Ok, let's close this PR then and revisit the issue when we will work on 5.4." So you've timed it perfectly! 😉

There are 2 things to discuss here:

Is CSRF still relevant (see #34004 (comment)) for today's Symfony applications, or should we rather deprecate the whole component?
There is a BC break when removing the extend from the component. I'm not aware of a way to trigger a deprecation for catching the wrong class: is there a way to accomplish this? If no, is this worth not making the change?

chalasr · 2021-07-19T13:08:45Z

As discussed privately, we cannot deprecate the security-csrf component now because supporting IE11 still matters and SameSite cookies aren't supported there. But the long-term goal is to remove the component.

About the original issue, considering the goal mentioned above, I don't think it's worth breaking BC personally.

javiereguiluz added the Security label Jul 16, 2021

javiereguiluz added this to the 5.4 milestone Jul 16, 2021

wouterj added the RFC label Jul 16, 2021

symfony / symfony

[Security] Decouple CSRF component from security-core #42148

[Security] Decouple CSRF component from security-core #42148

javiereguiluz commented Jul 16, 2021

wouterj commented Jul 16, 2021

chalasr commented Jul 19, 2021

symfony / symfony

Sponsor symfony/symfony

[Security] Decouple CSRF component from security-core #42148

[Security] Decouple CSRF component from security-core #42148

Comments

javiereguiluz commented Jul 16, 2021

wouterj commented Jul 16, 2021

chalasr commented Jul 19, 2021