<p dir="auto">On the standard login form, using 'form_login' in security.yml, the CSRF feature can be disabled by removing the 'csrf_provider'. However this does not seem to be the case for the 'simple_form'. The only way I can remove the CSRF is by adding a 'csrf_protection' = false to the setDefaultOptions() of the FormType.</p>
<p dir="auto">I'm not sure if this is intended behaviour or not, but messing about with firewall options from within a FormType (as in checking the csrf_provider status and programmatically disabling) could lead to a security breach.</p>
<p dir="auto">I've decided to use a model and a FormType for my Login form. This works great and is in my opinion a lot neater than the default approach in the docs (with the manually typed inputs etc...).</p>
<p dir="auto">However, it seems to me that it's impossible to validate the form. By validating the form, I mean adding constraints on the Login model and having them validated with <code class="notranslate">$form-&gt;handleRequest($request); if ($form-&gt;isValid()) ...</code>. This could be powerful as it would allow you firstly to make sure no empty credentials are checked and also because you could validate a username (e.g. it must be a valid email).</p>
<p dir="auto">I'm going through the code and as far as I can tell Symfony/Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener would have to be coupled with the form component. I understand why this is not the case at the moment.</p>
<p dir="auto">Is it possible to create a different Listener, one that is coupled with the Form component?</p>