[Stimulus/Turbo] CSRF not working in frames

[Hugo-Le-Goff]

Hello, I've been struggling for a while with CSRF and turbo frames. When a form is inside a frame, it starts at some point to throw invalid CSRF token errors.

First of all, I have the latest stimulus CSRF config of the recipe with :

# Enable stateless CSRF protection for forms and logins/logouts
framework:
    form:
        csrf_protection:
            token_id: submit

    csrf_protection:
        stateless_token_ids:
            - submit
            - authenticate
            - logout
        check_header: true # I added this one yesterday after finding about it somewhere

And the the latest version of csrf_protection_controller.js

After facing this problem a bunch of time, I realised that the problem happens when forms in a frames were on pages where there is no form. And it reminded me of another problem I faced, lazy stimulus controller not being initialized after a frame navigation on pages where the controller was not initially called. It make sense because only turbo visit update the lazy controllers loaded, but not a frame navigation.

So I looked into the csrf_protection_controller.js and found out that it was lazy loaded.

/* stimulusFetch: 'lazy' */
export default 'csrf-protection-controller';

After removing that lazy behavior line, everything started working fine. Beacause the csrf controller is available anywhere at anytime now I suppose.

Maybe my thought is wrong and I understand nothing about the CSRF with Turbo and Stimulus. I am bit overwhelmed by this topic since I started using Symfony UX, and I'm probably doing something wrong. But I wanted to share my finding here, maybe it's a real issue.

Also I wanted to ask about the necessity of check_header: true in the csrf config (can't remember where I found out about the need of this one, maybe it's useless). And to know about the LiveComponent and CORS system there are only few lines in the documentation about it, where are we supposed to configure it.

Thank you very much for all the awesome work on Symfony and Symfony UX, it's really a pleasure to work with it.

[smnandre]

I could be linked to: #2590 .. could you check the PR please ?