Weave Code
Csrf Route Bundle Laravel Package
genedys/csrf-route-bundle
A Laravel/PHP package for adding CSRF protection to routes, helping secure state-changing requests with token validation and straightforward route integration. Lightweight and simple to configure for safer forms and endpoints.
Symfony3 bundle which provides a simple way to add CSRF tokens on routes.
Frequently asked questions about Csrf Route Bundle
- Is genedys/csrf-route-bundle a Laravel package?
- No. It is a Symfony bundle registered through Symfony's Bundle and DependencyInjection lifecycle, not a Laravel package. It does not provide a Laravel service provider, facade, middleware alias, publishable config, or Blade directive. Laravel developers should treat it as a Symfony-only component that cannot be required into a Laravel app and used as-is.
- Can I install genedys/csrf-route-bundle with Composer in a Laravel application?
- You can run composer require, but the package will not integrate with Laravel's routing or security layers. There is no extra.laravel block or Laravel auto-discovery, and registration depends on Symfony kernel bundle registration. Installing it in Laravel would add unused Symfony code and may create dependency conflicts without providing usable CSRF protection.
- Does genedys/csrf-route-bundle support Laravel 10 or Laravel 11?
- No. The package targets Symfony with open-ended symfony/* >=3.3 and php >=5.5.9 constraints, and it does not declare Laravel 10/11 support. It has no Laravel middleware or service provider integration. There is no supported path for using this bundle in a Laravel 10 or Laravel 11 application.
- How is this different from Laravel's VerifyCsrfToken middleware?
- Laravel already provides route-scoped CSRF protection through the web middleware group and VerifyCsrfToken, including @csrf, X-CSRF-TOKEN, and _token handling. This Symfony bundle exists because Symfony's CSRF protection is form-centric and manual, a gap that does not exist in Laravel. In Laravel, the native middleware covers normal state-changing routes without this package.
- Does genedys/csrf-route-bundle work with Laravel's @csrf Blade directive?
- No. The bundle does not register a Blade directive or integrate with Laravel's session token manager. Laravel's @csrf emits a token validated by VerifyCsrfToken, while this package has its own Symfony-oriented token generation and validation. They are separate implementations and are not wired together.
- What should Laravel developers use instead for route-scoped CSRF tokens?
- Use Laravel's built-in VerifyCsrfToken and web middleware for standard form and session-backed routes. For stateless or signed route-bound tokens, use URL::temporarySignedRoute or Crypt::encryptString with a small custom middleware or route macro. For API or SPA flows, use Sanctum or a token strategy appropriate to the client. The realistic path is porting the route-intent idea into Laravel primitives, not installing this bundle.
- Is genedys/csrf-route-bundle safe to use in production?
- For Laravel use it is high risk because it is a Symfony bundle with an EOL Symfony 3.3 floor, unbounded version constraints, no visible test suite or CI coverage, one star, zero dependents, and a single maintainer. Unbounded symfony/* >=3.3 and php >=5.5.9 constraints can resolve modern components against old code, a dangerous failure mode for security code because it may install successfully and then validate permissively. Pin dependencies or avoid it unless you have audited the exact version.
- How do I configure token lifetime and failure behavior in genedys/csrf-route-bundle?
- The bundle advertises configurable token lifetime and failure behavior through its Symfony bundle configuration. In Laravel there is no publishable config file or service provider hook to set these values. If you are evaluating the Symfony bundle, configure it through Symfony's config and verify the 3.0.0 class changes because CsrfTokenManager was removed and its logic was redistributed.
- Does genedys/csrf-route-bundle support stateless or signed CSRF tokens?
- The overview does not establish whether tokens are session-backed, route-bound, or signed, and the technical assessment explicitly flags this as unresolved. It also asks whether tokens are single-use, rotated, and where they travel, because URL-borne tokens leak via Referer, access logs, and browser history. For Laravel, use URL::temporarySignedRoute or Crypt::encryptString for stateless route-bound tokens instead of assuming this bundle provides them.
- Is genedys/csrf-route-bundle maintained and tested?
- The 3.0.0 release shows the maintainer is active, but there are no CI badges, no visible coverage signal, one star, zero dependents, and a single maintainer. A major release that removes CsrfTokenManager and drops legacy shims improves maintainability for Symfony consumers, but it is not evidence of Laravel support or security correctness. Treat it as an unaudited Symfony component and review the 3.0.0 tag directly.
Weaver
How can I help you explore Laravel packages today?