- Can I use enumag/csrf-route-bundle in a Laravel application?
- No. enumag/csrf-route-bundle is a Symfony 3 bundle that registers a compiler pass, decorates Symfony's router service, and validates tokens in a Symfony kernel/controller listener. It has no Laravel ServiceProvider, facade, publishable config, or Illuminate-compatible middleware. Laravel's router and HTTP kernel are different abstractions, so forcing it in would mean bridging Symfony components into Laravel. That is a security-debt trade with no direct adoption path.
- How do I install enumag/csrf-route-bundle with Composer?
- The README installs genedys/csrf-route-bundle with Composer using the ^3.0 constraint, then registers GenedysCsrfRouteBundle in Symfony's bundles.php. That is Symfony bundle registration, not Laravel package discovery. The repository name enumag/csrf-route-bundle does not match the README's genedys/csrf-route-bundle install target, so resolve that identity mismatch before any lockfile review.
- Which Laravel versions does this package support?
- None. The package targets Symfony 3, which reached end of life in November 2018, with the 3.4 LTS ending in November 2021. There is no Laravel support matrix, no Laravel service provider, and no Illuminate middleware. Any transitive Symfony framework pin would be unpatched in a modern Laravel stack.
- How do I configure CSRF tokens on routes with this bundle?
- Configuration is Symfony YAML under genedys_csrf_route with enabled and field_name options, defaulting to true and _token. Routes then use a csrf_token option with token, intention, and methods parameters; the router appends the token query parameter and a controller listener validates it. There is no Laravel config file or route-level annotation equivalent in the package.
- Does this package protect GET routes from CSRF?
- Yes, the bundle's csrf_token methods option defaults to GET, so it can validate tokens on GET routes that mutate state. That is the real gap it targets, such as logout links, one-click delete or toggle actions, and GET-triggered state changes. Laravel's VerifyCsrfToken middleware covers POST, PUT, PATCH, and DELETE but not GET by default. In Laravel, implement that behavior with custom middleware rather than this Symfony bundle.
- What is the Laravel equivalent of per-route CSRF tokens without forms?
- Laravel already provides @csrf and csrf_token() for forms plus X-CSRF-TOKEN and X-XSRF-TOKEN for XHR and fetch requests through VerifyCsrfToken. What Laravel lacks out of the box is per-route opt-in protection for GET routes or a declarative route-level option. That is realistically a 40 to 80 line custom middleware or an extension of VerifyCsrfToken. The bundle is a design precedent for Laravel teams, not an installable asset.
- Is enumag/csrf-route-bundle maintained and safe for production?
- The signals are poor: zero stars, zero dependents, a readme maturity grade, a score around 0.03, no visible releases, and no CVE or issue triage. It sits directly on the authentication and authorization trust boundary where CSRF tokens are validated. An unmaintained, unauditable dependency there is a bad risk posture even for small code. Treat any future vulnerability as something you discover, not upstream.
- Why does the repository name differ from the Composer package name?
- The repository is enumag/csrf-route-bundle while the README and badges point to genedys/csrf-route-bundle. That is a supply-chain identity mismatch and must be resolved before the name appears in a dependency review or lockfile. It suggests a fork whose steward, release cadence, and patch policy are unknown. Do not assume the two names refer to the same maintained artifact without verifying ownership and history.
- What security details should I verify before trusting a CSRF package?
- An auditor will ask about constant-time comparison with hash_equals, session binding, and rotation on privilege change. Also check token lifetime, intention or scope handling, and whether the strategy covers server-rendered HTML and XHR or fetch headers. The README does not confirm hash_equals, session binding, or rotation-on-privilege-change. For Laravel, prefer the built-in VerifyCsrfToken or an audited custom middleware with those properties.
- How do I test CSRF route protection in a Laravel application?
- Use Laravel feature tests that assert a 419 response when the token is missing or invalid and a successful response when a valid session token is supplied. For custom GET-route protection, test state-changing GET requests explicitly because VerifyCsrfToken does not cover them by default. Test both HTML form posts and XHR or fetch requests with the appropriate header strategy. The Symfony listener and router decoration in this bundle cannot be exercised as Laravel middleware tests.