a SensioLabs Product

The PHP micro-framework
based on the Symfony Components

You are reading the documentation for Silex 2.0. Switch to the documentation for Silex 1.3.

Questions & Feedback


Creative Commons License Silex documentation is licensed under a Creative Commons Attribution-Share Alike 3.0 Unported License.

Disabling CSRF Protection on a Form using the FormExtension

The FormExtension provides a service for building form in your application with the Symfony Form component. When the CSRF Service Provider is registered, the FormExtension uses the CSRF Protection avoiding Cross-site request forgery, a method by which a malicious user attempts to make your legitimate users unknowingly submit data that they don't intend to submit.

You can find more details about CSRF Protection and CSRF token in the Symfony Book.

In some cases (for example, when embedding a form in an html email) you might want not to use this protection. The easiest way to avoid this is to understand that it is possible to give specific options to your form builder through the createBuilder() function.


$form = $app['form.factory']->createBuilder('form', null, array('csrf_protection' => false));

That's it, your form could be submitted from everywhere without CSRF Protection.

Going further

This specific example showed how to change the csrf_protection in the $options parameter of the createBuilder() function. More of them could be passed through this parameter, it is as simple as using the Symfony getDefaultOptions() method in your form classes. See more here.

Website powered by Symfony and Twig, deployed on
The Silex logo is © 2010-2017 SensioLabs