manually submitting symfony form results in CSRF error - forms

Question

I would like to be able to manually submit a symfony form with data I create but it seems I am missing the CSRF token in the submitted data and so the validation fails.
The form is simple - just one field (let's say 'name' for argument) as a text field with no constraints.
$data = [];
if ($someCondition) {
$data['name'] = 'steve';
}
$form = $this->createForm('FooType', $data);
if (!empty($data)) {
$form->submit($data);
} else {
$form->handleRequest($request);
}
if ($form->isSubmitted() && $form->isValid()) {
// do something
}
if I set $data['name'] the form submits but I get The CSRF token is invalid. Please try to resubmit the form.
so obviously, I am missing the token. I know I can disable the CSRF protection, but I don't want to do this as there is also an option to 'normally' interact with the form.
How to I submit a proper token or override this behavior?

Answer 1

I see you tagged this as symfony2 question. With that in mind, you can supply a valid CSRF token by injecting it into your data, thought, solution differ in <2.6 and >=2.6 version, as far as I'm aware.
Pre 2.6 version:
$provider = $this->get('form.csrf_provider');
$token = $provider->generateCsrfToken(''); // INTENTION = empty_string, by default
$data['<<YOUR_FORM_NAME']['_token'] = $token; // be sure to change the form name
Versions 2.6+
The thing is a bit different as forms now use TokenManagerInterface provided by Security component:
$tokenId = ....;
$token= (string) $this->get('security.csrf.token_manager')->getToken($tokenId);
$tokenValue = $token->getValue();
Now, the $tokenId can be many things, as described in a Form's public test:
$tokenId = $options['csrf_token_id'] ?:
($form->getName() ?:
get_class($form->getConfig()->getType()->getInnerType()));
But if you look into this, the default will be $form->getName(), up until 2.8. I think that 2.8 removed abstraction from the getName() method, thus, the 2.8 and later will user the clunky value:
get_class($form->getConfig()->getType()->getInnerType())
This all holds true, unless you injection csrf_token_id option in your form type.
UPDATE:
Ok, so it seems my bad presumption was about the token key. While you did get the valid token, that one was not used. In my example, I had separate FormType namespaced AppBundle\Form\SomeFooType and the actual token id that was used was some_foo.
I have made a pastebin of the working example (version 2.8.8, same worked in 3.1.2 as expected): http://pastebin.com/ks2jSeh7
Hope this helps a bit.