title: customer authenticator + form_login options break all csrf tokens
body: <p>I have a Symfony 3.3.13 system with various forms.</p>
  
  <p>To achieve "deep-linking" in these forms, ie. being able to click on an email link, login and then be redirected to the form I have added the following changes:</p>
  
  <p>config.yml</p>
  
  <pre><code>framework:
      secret:          "%secret%"
      router:
          resource: "%kernel.root_dir%/config/routing.yml"
          strict_requirements: ~
      form:            ~
      csrf_protection: ~
      ...
      more
      ...
  </code></pre>
  
  <p>security.yml</p>
  
  <pre><code>security:
      providers:
          zog:
              id: app.zog_user_provider
  
  
      firewalls:
          dev:
              pattern: ^/(_(profiler|wdt)|css|images|js)/
              security: false
          main:
              anonymous: ~
              logout:
                  path:   /logout
                  target: /
              guard:
                  authenticators:
                      - app.legacy_token_authenticator
                      - app.token_authenticator
                  entry_point: app.legacy_token_authenticator
              form_login:                                         &lt;--this line alone breaks CSRF 
                  use_referer: true                               &lt;--I tried partial combinations, none seems to make CSRF work
                  login_path: /security/login
                  use_forward: true
                  success_handler: login_handler
                  csrf_token_generator: security.csrf.token_manager   &lt;--added based on answer, doesn't help
  </code></pre>
  
  <p>src/AppBundle/Resources/config/services.yml</p>
  
  <pre><code>login_handler:
      class: AppBundle\Service\LoginHandler
      arguments: ['@router', '@doctrine.orm.entity_manager', '@service_container']
  </code></pre>
  
  <p>src/AppBundle/Service/Loginhandler.php</p>
  
  <pre><code>&lt;?php
  /**
   * Created by PhpStorm.
   * User: jochen
   * Date: 11/12/17
   * Time: 12:31 PM
   */
  
  namespace AppBundle\Service;
  
  use Symfony\Component\HttpFoundation\Request;
  use Symfony\Component\HttpFoundation\RedirectResponse;
  use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
  use Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface;
  use Symfony\Component\Routing\RouterInterface;
  use Doctrine\ORM\EntityManager;
  
  class LoginHandler implements AuthenticationSuccessHandlerInterface
  {
      private $router;
      private $container;
      private static $key;
  
      public function __construct(RouterInterface $router, EntityManager $em, $container) {
  
          self::$key = '_security.main.target_path';
  
          $this-&gt;router = $router;
          $this-&gt;em = $em;
          $this-&gt;session = $container-&gt;get('session');
  
      }
  
      public function onAuthenticationSuccess( Request $request, TokenInterface $token ) {
  
          //check if the referer session key has been set
          if ($this-&gt;session-&gt;has( self::$key )) {
  
              //set the url based on the link they were trying to access before being authenticated
              $route = $this-&gt;session-&gt;get( self::$key );
  
              //remove the session key
              $this-&gt;session-&gt;remove( self::$key );
              //if the referer key was never set, redirect to a default route
              return new RedirectResponse($route);
          } else{
  
              $url = $this-&gt;generateUrl('portal_job_index');
  
              return new RedirectResponse($url);
  
          }
  
  
  
      }
  }
  </code></pre>
  
  <p>I have also made sure that csrf is enabled on the login form like this:</p>
  
  <p>src/AppBundle/resources/views/security/login.html.twig</p>
  
  <pre><code>        &lt;form action="{{ path('app_security_login') }}" method="post" autocomplete="off"&gt;
              &lt;input type="hidden" name="_csrf_token"
                     value="{{ csrf_token('authenticate') }}"
              &gt;
  </code></pre>
  
  <p>app/config/services.yml</p>
  
  <pre><code>app.legacy_token_authenticator:
      class: AppBundle\Security\LegacyTokenAuthenticator
      arguments: ["@router", "@session", "%kernel.environment%", "@security.csrf.token_manager"]
  </code></pre>
  
  <p>src/AppBundle/Security\legacyTokenAuthenticator</p>
  
  <pre><code>    class LegacyTokenAuthenticator extends AbstractGuardAuthenticator
      {
          private $session;
  
          private $router;
  
          private $csrfTokenManager;
  
          public function __construct(
              RouterInterface $router,
              SessionInterface $session,
              $environment,
              CsrfTokenManagerInterface $csrfTokenManager
          ) {
              if ($environment != 'test'){
                  session_start();
              }
              $session-&gt;start();
              $this-&gt;setSession($session);
              $this-&gt;csrfTokenManager = $csrfTokenManager;
              $this-&gt;router = $router;
          }
  
  
          /**
           * @return mixed
           */
          public function getSession()
          {
              return $this-&gt;session;
          }
  
  
          /**
           * @param mixed $session
           */
          public function setSession($session)
          {
              $this-&gt;session = $session;
          }
  
  
          /**
           * Called on every request. Return whatever credentials you want,
           * or null to stop authentication.
           */
          public function getCredentials(Request $request)
          {
              $csrfToken = $request-&gt;request-&gt;get('_csrf_token');
  
              if (false === $this-&gt;csrfTokenManager-&gt;isTokenValid(new CsrfToken('authenticate', $csrfToken))) {
                  throw new InvalidCsrfTokenException('Invalid CSRF token.');
              }
              $session = $this-&gt;getSession();
  
              if (isset($_SESSION['ADMIN_logged_in']) &amp;&amp; intval($_SESSION['ADMIN_logged_in'])){
                  return $_SESSION['ADMIN_logged_in'];
              }
              return;
          }
  
          public function getUser($credentials, UserProviderInterface $userProvider)
          {
              return $userProvider-&gt;loadUserByUserId($credentials);
          }
  
          public function checkCredentials($credentials, UserInterface $user)
          {
              return $user-&gt;getUsername() == $credentials;
          }
  
          public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
          {
              return null;
          }
  
          public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
          {
              return null;
          }
  
          /**
           * Called when authentication is needed, but it's not sent
           */
          public function start(Request $request, AuthenticationException $authException = null)
          {
              $url = $this-&gt;router-&gt;generate('app_security_login');
              return new RedirectResponse($url);
          }
  
          public function supportsRememberMe()
          {
              return false;
          }
  
  
      }
  </code></pre>
  
  <p>All CSRF checks - including on the login form - fail always when I add the 5 lines in security.yml starting with form_login. The error I get is: </p>
  
  <pre><code>The CSRF token is invalid. Please try to resubmit the form. portalbundle_portal_job 
  </code></pre>
  
  <p>Caused by:</p>
  
  <p>When I remove these 5 lines, all CSRF tokens work.</p>