title: PHP - CSRF Protection with Symfony
body: <p>I need to create a login form with Symfony and protect it with CSRF protection.</p>
  <p>So I use FormBuilder of Symfony.
  When the user enter his email and password and submit the form he stay on the same page and the form builder send me that there is an error with CSRF Token.</p>
  <p>If I debug the session variable and the token from the form there are different. But when the user reload the page it's ok those two variables are equals. It's like my session is overwrite or something like this.
  The login page are on one url and the page where it redirect on another url.
  Those two domains are on HTTPS.</p>
  <p><img src="https://i.stack.imgur.com/qxd0C.png" alt="My session at first attempt" /></p>
  <p><img src="https://i.stack.imgur.com/91XkU.png" alt="My form variables at first attempt" /></p>
  <p><img src="https://i.stack.imgur.com/5O0HF.png" alt="My session at second attempt" /></p>
  <p><img src="https://i.stack.imgur.com/6PMWe.png" alt="My form variables at second attempt" /></p>
  <p>This is the code of my controller:</p>
  <pre><code>    $userForm = new Users();
      $form = $this-&gt;createFormBuilder($userForm)
          -&gt;add('email', EmailType::class)
          -&gt;add('password', PasswordType::class)
          -&gt;add('connect', SubmitType::class)
          -&gt;getForm();
  
      $form-&gt;handleRequest($request);
  
      if($form-&gt;isSubmitted() &amp;&amp; $form-&gt;isValid()) {
          $userForm = $form-&gt;getData();
  
          $user = $this-&gt;getDoctrine()-&gt;getRepository(Users::class)
              -&gt;findOneBy(array('email' =&gt; $userForm-&gt;getEmail(), 'is_activated' =&gt; 1));
  
          if ($user != null) {
              if (password_verify($userForm-&gt;getPassword(), $user-&gt;getPassword())) {
                  $id_user = $user-&gt;getId();
              }
          }
  
          if (isset($id_user)) {
              $redirectURL = &quot;my-redirect-url&quot;;
          }
  
          return $this-&gt;redirect($redirectURL);
      }
      return $this-&gt;render('View/login-debug.html.twig', ['form' =&gt; $form-&gt;createView()]);
  </code></pre>
  <p>And on my twig view I use the formbuilder : {{form}}.
  So I hope it create the token in the right way !</p>
  <p>I think I've made a little mistake on my script but I don't know where ...</p>