title: Zend Framework 2 CSRF Protection
body: <p>Currently I try to use the CSRF Protection of the Zend Framework 2.</p>
  
  <p>But everytime I send my form, I got this error message:</p>
  
  <blockquote>
    <p>The form submitted did not originate from the expected site</p>
  </blockquote>
  
  <p>I have implemeted the CSRF Protection in this way:</p>
  
  <p>1) created a Form Class and added the csrf:</p>
  
  <pre><code>$this-&gt;add(array(
      'type' =&gt; 'Zend\Form\Element\Csrf',
      'name' =&gt; 'secret',
      'options' =&gt; array(
          'csrf_options' =&gt; array(
              'timeout' =&gt; 600
          )
      )
  ));
  </code></pre>
  
  <p>2) echoed the csrf element in the view file:</p>
  
  <pre><code> echo $this-&gt;form()-&gt;openTag($forgotPasswordForm);
   echo $this-&gt;formRow($forgotPasswordForm-&gt;get('email'));
   echo $this-&gt;formRow($forgotPasswordForm-&gt;get('secret'));
   echo $this-&gt;formSubmit($forgotPasswordForm-&gt;get('submit'));
   echo $this-&gt;form()-&gt;closeTag($forgotPasswordForm);
  </code></pre>
  
  <p>I figured out that the csrf token isn't stored in the session, but why?</p>