[Turbo] Correctly fix framework.csrf_protection.check_header configuration

[Kocal]

Q	A
License	MIT
Doc issue/PR	symfony/symfony-docs#...

Following #1439 (comment)

Old alternative with `position: 'bottom'`

The solution is fragile and kind of ugly (note the extra line before check_header: true, as it generates the following file:

# Enable stateless CSRF protection for forms and logins/logouts
framework:
    form:
        csrf_protection:
            token_id: submit

    csrf_protection:
        stateless_token_ids:
            - submit
            - authenticate
            - logout

        check_header: true

But it works:

➜  app-flex-1440 git:(main) ✗ sfc debug:config framework csrf_protection

Current configuration for "framework.csrf_protection"
=====================================================

stateless_token_ids:
    - submit
    - authenticate
    - logout
check_header: true
enabled: null
cookie_name: csrf-token

There are other alternatives, like:

1. introducing position before_target for add-lines modifier but it requires to update Flex code and people to upgrade Flex
2. or drop UX Turbo recipe and add # check_header: true (with a comment) to the csrf.yaml from Form recipe

Applied @xabbuh 's suggestion from #1440 (comment)

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Define the SYMFONY_ENDPOINT environment variable:

   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1440/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1440/index.json

2. Install the package(s) related to this recipe:

   composer req symfony/flex
   composer req 'symfony/ux-turbo:^2.20'

3. Don't forget to unset the SYMFONY_ENDPOINT environment variable when done:

   # On Unix-like (BSD, Linux and macOS)
   unset SYMFONY_ENDPOINT
   # On Windows
   SET SYMFONY_ENDPOINT=

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.

symfony/ux-turbo

2.19 vs 2.20

diff --git a/symfony/ux-turbo/2.20/config/packages/ux_turbo.yaml b/symfony/ux-turbo/2.20/config/packages/ux_turbo.yaml
new file mode 100644
index 0000000..c2a6a44
--- /dev/null
+++ b/symfony/ux-turbo/2.20/config/packages/ux_turbo.yaml
@@ -0,0 +1,4 @@
+# Enable stateless CSRF protection for forms and logins/logouts
+framework:
+    csrf_protection:
+        check_header: true
diff --git a/symfony/ux-turbo/2.19/manifest.json b/symfony/ux-turbo/2.20/manifest.json
index 1fa03bf..7dd9f95 100644
--- a/symfony/ux-turbo/2.19/manifest.json
+++ b/symfony/ux-turbo/2.20/manifest.json
@@ -1,5 +1,13 @@
 {
     "bundles": {
         "Symfony\\UX\\Turbo\\TurboBundle": ["all"]
+    },
+    "copy-from-recipe": {
+        "config/": "%CONFIG_DIR%/"
+    },
+    "aliases": ["turbo"],
+    "conflict": {
+        "symfony/framework-bundle": "<7.2",
+        "symfony/security-csrf": "<7.2"
     }
 }

[grelf111]

After running composer require symfony/webapp-pack, Symfony Flex installs the latest symfony/framework-bundle recipe, which now generates an invalid YAML file:

File: config/packages/csrf.yaml
framework:
csrf_protection:
enabled: true
token_id: submit
❌ This causes a fatal YAML parse error:

A colon cannot be used in an unquoted mapping value at line 3 (near "token_id: submit")
✅ Expected: submit should be wrapped in quotes:

token_id: 'submit'
Tested with:

Symfony version: [7.3.1]

PHP version: 8.3

Symfony CLI or Composer install

Please fix or update the recipe in recipes/symfony/framework-bundle.

[xabbuh]

The thing is that this solution only works if the developer didn't change/rearrange the content of the file. I don't have a better idea though that doesn't involve updating Flex to be more flexible when it comes to adding lines to existing config files. :/

[Kocal]

What about dropping the UX Turbo recipe, and directly add # check_header: true to the csrf.yaml from Form recipe?

That's far from being ideal, but better that the solution proposed in this PR.

[xabbuh]

The UX Turbo recipe could also create a new file with just the following content instead of trying to patch the existing file:

# Enable stateless CSRF protection for forms and logins/logouts
framework:
    csrf_protection:
        check_header: true

[Kocal]

Indeed, didn't think about this but I feel like this is the best alternative we have without touching Flex.

I'm updating the PR

[xabbuh]

LGTM