title: API Rest "The CSRF token is invalid. Please try to resubmit the form."
body: <p>I'm looking to combine FOS Rest Bundle AND FOS User Bundle to my API application to register new users. The problem is:</p>
  
  <ul>
  <li>Can't found best practices for user registration on API Rest</li>
  <li>Unable to register a user using fos user registration type, got 400 Bad Request with "The CSRF token is invalid. Please try to resubmit the form."</li>
  </ul>
  
  <p>How can I resolve those issues?</p>
  
  <p><strong>My POST Body</strong></p>
  
  <pre><code>{
      "firstname": "xxx",
      "lastname": "xxx",
      "email":"xxxxx@xxxx.com",
      "username":"xxx",
      "plainPassword":{
          "first":"xxx",
          "second":"xxx"
      }
  }
  </code></pre>
  
  <p><strong>Response</strong>:</p>
  
  <pre><code>{
      "errors": [
          "The CSRF token is invalid. Please try to resubmit the form."
      ],
      "children": {
          "email": {},
          "username": {},
          "plainPassword": {
              "children": {
                  "first": {},
                  "second": {}
              }
          },
          "firstname": {},
          "lastname": {}
      }
  }
  </code></pre>
  
  <p><strong>UserType Form</strong></p>
  
  <pre><code>class UserType extends AbstractType
      {
          /**
           * @inheritDoc
           */
          public function buildForm(FormBuilderInterface $builder, array $options)
          {
              $builder
                  -&gt;add('firstname')
                  -&gt;add('lastname');
          }
  
          public function configureOptions(OptionsResolver $resolver)
          {
              $resolver-&gt;setDefaults([
                  'crsf_protection' =&gt; false,
                  'csrf_token_id' =&gt; null,
                  'data_class' =&gt; 'TM\UserBundle\Document\User'
              ]);
          }
  
          public function getParent()
          {
              return 'FOS\UserBundle\Form\Type\RegistrationFormType';
  
              // Or for Symfony &lt; 2.8
              // return 'fos_user_registration';
          }
      }
  </code></pre>
  
  <p><strong>The Controller</strong></p>
  
  <pre><code>class UserController extends FOSRestController
  {
      /**
       * @Rest\Post("/register")
       * @param Request $request
       * @return null|Response
       */
      public function postUserAction(Request $request)
      {
          /** @var $formFactory FormFactory */
          $formFactory = $this-&gt;get('form.factory');
          /** @var $userManager UserManagerInterface */
          $userManager = $this-&gt;get('fos_user.user_manager');
          /** @var $dispatcher EventDispatcherInterface */
          $dispatcher = $this-&gt;get('event_dispatcher');
  
          $user = $userManager-&gt;createUser();
          $user-&gt;setEnabled(true);
  
          $event = new GetResponseUserEvent($user, $request);
          $dispatcher-&gt;dispatch(FOSUserEvents::REGISTRATION_INITIALIZE, $event);
  
          if (null !== $event-&gt;getResponse()) {
              return $event-&gt;getResponse();
          }
  
          $form = $formFactory-&gt;create(UserType::class, $user);
  
          $form-&gt;submit($request-&gt;request-&gt;all());
  
          if ($form-&gt;isValid()) {
              $event = new FormEvent($form, $request);
              $dispatcher-&gt;dispatch(FOSUserEvents::REGISTRATION_SUCCESS, $event);
  
              $userManager-&gt;updateUser($user);
  
              if (null === $response = $event-&gt;getResponse()) {
                  $url = $this-&gt;generateUrl('fos_user_registration_confirmed');
                  $response = new RedirectResponse($url);
              }
  
              $dispatcher-&gt;dispatch(FOSUserEvents::REGISTRATION_COMPLETED, new FilterUserResponseEvent($user, $request, $response));
  
              $view = $this-&gt;view(array('token' =&gt; $this-&gt;get("lexik_jwt_authentication.jwt_manager")-&gt;create($user)), Response::HTTP_CREATED);
  
              return $this-&gt;handleView($view);
          }
  
          $view = $this-&gt;view($form, Response::HTTP_BAD_REQUEST);
          return $this-&gt;handleView($view);
      }
  }
  </code></pre>