- Is fantoine/csrf-route-bundle a Laravel package?
- No. It is a Symfony2 bundle built for the Symfony 2.x kernel and bundle model, using dependency injection extensions and kernel request listeners. It has no Laravel service provider or middleware integration. Evaluating it as a Laravel package is a category error.
- Can I install fantoine/csrf-route-bundle in a Laravel application?
- There is effectively no supported installation path. The bundle targets Symfony 2.x container and event semantics and expects PHP 5.3 or 5.4 era runtimes, which conflict with the modern Symfony components Laravel pulls in. You would need ignore-platform-reqs flags or a hard fork to attempt it. Neither is advisable for a security-related dependency.
- Does Laravel need this bundle for per-route CSRF tokens?
- No. Laravel already provides CSRF protection through VerifyCsrfToken middleware, the csrf_field and @csrf Blade directives, the X-CSRF-TOKEN header, and URL signed routes. For one-time action links, temporarySignedRoute plus signature validation covers the use case without third-party code. There is no architectural gap for this bundle to fill.
- Which Laravel versions support fantoine/csrf-route-bundle?
- None. The package is a Symfony2 bundle and does not ship a Laravel service provider, middleware, or configuration contract. No Laravel version is supported, and none will be. Laravel 10 and 11 rely on Symfony 5, 6, or 7 components that cannot coexist cleanly with a Symfony 2.x bundle.
- How do I add CSRF tokens to specific routes in Laravel without this bundle?
- Use Laravel's built-in CSRF middleware and emit tokens with csrf_field or @csrf in forms, or send the X-CSRF-TOKEN header for JavaScript requests. If you need to exclude specific routes from automatic checks, adjust the middleware except list. For per-route one-time actions, use signed URLs and hasValidSignature validation instead of a custom token bundle.
- What are the alternatives to fantoine/csrf-route-bundle for Laravel?
- The primary alternative is Laravel's native CSRF middleware and signed URL support, which are maintained with the framework. If you genuinely need a custom per-route token, write a small Laravel middleware that mints, stores, and validates the token plus a Blade directive to emit it. For Symfony projects, use Symfony's own CSRF component rather than a dormant Symfony2 bundle.
- Is fantoine/csrf-route-bundle maintained and safe for production?
- It is abandoned, has very low adoption, and targets a PHP 5.3 or 5.4 era runtime with Symfony 2.x APIs. There is no CVE monitoring and no upstream responsiveness. Because CSRF sits directly on a security boundary, adopting unmaintained and unreviewed code there is a high risk that should not be accepted regardless of functionality.
- How would I migrate fantoine/csrf-route-bundle to Laravel?
- Do not migrate the package itself; migrate the idea if a real requirement exists. A native implementation is roughly a middleware that mints a token, binds it to the session or a signed payload, and validates it on the target route, plus a Blade directive to emit it. That produces a small, auditable, fully owned surface area and avoids carrying a fork.
- Does fantoine/csrf-route-bundle work with PHP 8.2 and Laravel 10 or 11?
- No. Expect PHP 5.3 to 5.6 era syntax and Symfony 2.x APIs, which are incompatible with modern PHP 8.2 runtimes and with the Symfony 5, 6, or 7 components Laravel depends on. Installation would likely fail platform requirements or require ignoring them. That is a strong signal not to proceed.
- When should I use a per-route CSRF token instead of Laravel's default middleware?
- Only when you can document a concrete flow that fails with built-in CSRF protection, such as a cross-session one-time action link, and even then signed URLs usually solve it. Start with a requirements spike and reproduction cases, then prototype a native Laravel middleware against one route. Run a security review covering token entropy, rotation, fixation, replay window, and multi-tab behavior before considering any third-party dependency.