Skip to content

[Security] Improve security logout options #18277

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 11 additions & 8 deletions reference/configuration/security.rst
Original file line number Diff line number Diff line change
Expand Up @@ -448,10 +448,13 @@ redirected to the ``default_target_path`` to avoid a redirection loop.
For historical reasons, and to match the misspelling of the HTTP standard,
the option is called ``use_referer`` instead of ``use_referrer``.

**Options Related to Logout Configuration**
logout
~~~~~~

You can configure logout options.

invalidate_session
~~~~~~~~~~~~~~~~~~
..................

**type**: ``boolean`` **default**: ``true``

Expand All @@ -466,14 +469,14 @@ the current firewall and not the other ones.
.. _reference-security-logout-success-handler:

``path``
~~~~~~~~
........

**type**: ``string`` **default**: ``/logout``

The path which triggers logout. You need to set up a route with a matching path.

target
~~~~~~
......

**type**: ``string`` **default**: ``/``

Expand All @@ -482,7 +485,7 @@ starts with ``http://`` or ``https://``) or the route name (otherwise) to
redirect after logout.

success_handler
~~~~~~~~~~~~~~~
...............

.. deprecated:: 5.1

Expand All @@ -501,22 +504,22 @@ If it is set, the logout ``target`` option will be ignored.
.. _reference-security-logout-csrf:

csrf_parameter
~~~~~~~~~~~~~~
..............

**type**: ``string`` **default**: ``'_csrf_token'``

The name of the parameter that stores the CSRF token value.

csrf_token_generator
~~~~~~~~~~~~~~~~~~~~
....................

**type**: ``string`` **default**: ``null``

The ``id`` of the service used to generate the CSRF tokens. Symfony provides a
default service whose ID is ``security.csrf.token_manager``.

csrf_token_id
~~~~~~~~~~~~~
.............

**type**: ``string`` **default**: ``'logout'``

Expand Down