title: How to get login form CSRF protection working in Symfony 2.1?
body: <p>I can't seem to get login form CSRF protection working happily using Symfony 2.1. </p>
  
  <p>In config.yml, csrf_protection is set to true. The login form is rendering a hidden input named 'form[_token]']. In security.yml:</p>
  
  <pre><code>csrf_parameter: form[_token]
  intention: authenticate
  </code></pre>
  
  <p>With this configuration, I can login without issue. But the CSRF token is not being checked. I confirmed this by removing the hidden input field before submitting the form:</p>
  
  <pre><code>&lt;input type="hidden" id="form__token" name="form[_token]" value="9b2f5d5efabb938ff8d83c2c8318db1377a3ef16"&gt;
  </code></pre>
  
  <p>If I add a csrf_provider configuration setting to security.yml, I can no longer login, getting the error "Invalid CSRF token"</p>
  
  <pre><code>csrf_provider: form.csrf_provider
  </code></pre>
  
  <p>I've read whatever I could find on the topic and nothing seems to work correctly - except for what I read in this article: <a href="http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/" rel="nofollow">http://henrik.bjrnskov.dk/symfony2-cross-site-request-forgery/</a>. That stuff seems to have been pulled into Friends of Symfony: <a href="https://github.com/FriendsOfSymfony/FOSUserBundle/pull/469" rel="nofollow">https://github.com/FriendsOfSymfony/FOSUserBundle/pull/469</a>, which I am not using. </p>
  
  <p>The post instructs you to:</p>
  
  <ul>
  <li><p>generate a token manually in the loginAction:</p>
  
  <p>$csrfToken = $this->container->get('form.csrf_provider')->generateCsrfToken('authentication');</p></li>
  <li><p>send it to the view</p></li>
  <li><p>and render it manually in the form</p>
  
  <p></p></li>
  </ul>
  
  <p>which is annoying.</p>
  
  <p>The question basically comes down to - should CSRF protection work in Symfony 2.1 for login forms using only configuration settings, or will I need to modify my loginAction and template to get it working?</p>