How to manage CRSV token manually in Symfony? - security

Question

I'm trying to use the CRSF token management without a FormType. So in a twig template i just use that to generate a token:
{{ csrf_token( inception_inscription ) }}
In the controller i'm trying this :
$tokenManager = $this->get('security.csrf.token_manager');
$token = $request->get('token');
inception = $this->container->getParameter('crsf_inscription_inception');
if (!$tokenManager->isTokenValid($tokenManager->getToken($inception, $token))) {
throw new HttpException(400, 'Invalid token');
}
But in fact the method isTokenValid always return true. I can force the $token vaiable to what i want, it's never false, so the validation is useless.
When i do debug step by step, i walk throught a Symfony\Component\Security\Csrf::getToken() and that method is testing that : ($this->storage->hasToken($tokenId)) whic always return false and force the process to generate a new Token.
I don't really undertand how it works.
Here is ore information about my code :
Symfony 2.6.x
framework:
secret: "%secret%"
router:
resource: "%kernel.root_dir%/config/routing.yml"
strict_requirements: ~
form:
csrf_protection:
enabled: true
field_name: token_my
csrf_protection:
enabled: true
validation: { enable_annotations: true }
templating:
engines: ['twig']
#assets_version: SomeVersionScheme
default_locale: "%locale%"
trusted_hosts: ~
trusted_proxies: ~
session:
handler_id: ~
name: 'my'
fragments: ~
http_method_override: true
# Twig Configuration
twig:
debug: "%kernel.debug%"
strict_variables: "%kernel.debug%"
globals:
inception_inscription: %crsf_inscription_inception%

Answer 1

From what I understand, $tokenManager->getToken($tokenId) always generates a new, valid token. You would probably check the provided token instead, e.g.:
$tokenManager = $this->get('security.csrf.token_manager');
$tokenId = $this->container->getParameter('crsf_inscription_inception');
$tokenValue = $request->get('token');
$token = new CsrfToken($tokenId, $tokenValue);
if (!$tokenManager->isTokenValid($token)) {
throw new HttpException(400, 'Invalid token');
}