Skip to content

Commit a59e390

Browse files
committed
minor #2443 [LiveComponent] Update CSRF docs (smnandre)
This PR was merged into the 2.x branch. Discussion ---------- [LiveComponent] Update CSRF docs * fix some RST syntax * minor rewording Passing by * remove empty attribute constructors Commits ------- b4f96ff [LiveComponent] Update CSRF docs
2 parents a6be69e + b4f96ff commit a59e390

File tree

1 file changed

+13
-11
lines changed

1 file changed

+13
-11
lines changed

src/LiveComponent/doc/index.rst

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ Suppose you've already built a basic Twig component::
110110

111111
use Symfony\UX\TwigComponent\Attribute\AsTwigComponent;
112112

113-
#[AsTwigComponent()]
113+
#[AsTwigComponent]
114114
class RandomNumber
115115
{
116116
public function getRandomNumber(): int
@@ -138,7 +138,7 @@ re-rendered live on the frontend), replace the component's
138138
+ use Symfony\UX\LiveComponent\Attribute\AsLiveComponent;
139139
+ use Symfony\UX\LiveComponent\DefaultActionTrait;
140140
141-
- #[AsTwigComponent()]
141+
- #[AsTwigComponent]
142142
+ #[AsLiveComponent]
143143
class RandomNumber
144144
{
@@ -1221,7 +1221,7 @@ You can also pass arguments to your action by adding each as a
12211221
</form>
12221222

12231223
In your component, to allow each argument to be passed, add
1224-
the ``#[LiveArg()]`` attribute::
1224+
the ``#[LiveArg]`` attribute::
12251225

12261226
// src/Twig/Components/ItemList.php
12271227
namespace App\Twig\Components;
@@ -1244,15 +1244,17 @@ the ``#[LiveArg()]`` attribute::
12441244
Actions and CSRF Protection
12451245
~~~~~~~~~~~~~~~~~~~~~~~~~~~
12461246

1247-
When you trigger an action, a POST request is sent that contains a
1248-
custom ``Accept`` header. This header is automatically populated and
1249-
validated. In other words you get CSRF protection without any work
1250-
thanks to same-origin / CORS policies implemented by browsers.
1247+
When an action is triggered, a POST request is sent with a custom ``Accept``
1248+
header. This header is automatically set and validated for you. In other
1249+
words, you benefit from CSRF protection effortlessly, thanks to the
1250+
``same-origin`` and ``CORS`` policies enforced by browsers.
12511251

1252-
If you want this built-in CSRF protection to be effective, mind your
1253-
CORS headers (e.g. *DO NOT* use `Access-Control-Allow-Origin: *`).
1252+
.. warning::
12541253

1255-
(In test-mode, the CSRF protection is disabled to make testing easier.)
1254+
To ensure this built-in CSRF protection remains effective, pay attention
1255+
to your CORS headers (e.g. *DO NOT* use ``Access-Control-Allow-Origin: *``).
1256+
1257+
In test-mode, the CSRF protection is disabled to make testing easier.
12561258

12571259
Actions, Redirecting and AbstractController
12581260
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -2972,7 +2974,7 @@ However, if the user adds a *new* todo item then we *do* want the ``TodoFooter``
29722974
child component to re-render: using the new ``count`` value. To trigger this,
29732975
in the ``TodoFooter`` component, add the ``updateFromParent`` option::
29742976

2975-
#[LiveComponent()]
2977+
#[LiveComponent]
29762978
class TodoFooter
29772979
{
29782980
#[LiveProp(updateFromParent: true)]

0 commit comments

Comments
 (0)