Stack Exchange
addCSRFProtection Not Working in public function configure()
When I apply this code:
class ContactoForm extends BaseContactoForm
{
    public function configure()
    {
        $this->addCSRFProtection(rand(1, 1000));
    }
}

Then I go to action.php a module:
$this->form = new ContactoForm();

The field does not change _csrf_token:
Refresh 1:
<input type="hidden" id="contacto__csrf_token" value="d6e64fcc34a99c1c90dd95eef945e564" name="contacto[_csrf_token]">

Refresh 2:
<input type="hidden" id="contacto__csrf_token" value="d6e64fcc34a99c1c90dd95eef945e564" name="contacto[_csrf_token]">

Refresh N:
<input type="hidden" id="contacto__csrf_token" value="d6e64fcc34a99c1c90dd95eef945e564" name="contacto[_csrf_token]">

But if I apply it from the action:
$this->form = new ContactoForm();
$this->form->addCSRFProtection(rand(1, 1000));

Here if you change
Refresh 1:
<input type="hidden" id="contacto__csrf_token" value="22815f44f18e41947d7568c0771abda4" name="contacto[_csrf_token]">

Refresh 2:
<input type="hidden" id="contacto__csrf_token" value="38bfae0a71a79d16b39ce943658f2700" name="contacto[_csrf_token]">

Refresh 3:
<input type="hidden" id="contacto__csrf_token" value="882c989dc95e40406b28200631cffc3d" name="contacto[_csrf_token]">

In symfony 1.2, it worked.
Now in symfony 1.4 does not work, please help me, thanks.

I can't say that I know symfony, but from your example it shows that configure() isn't getting called when you create a new instance of ContactoForm.  Try calling it explicitly in the constructor of ContactoForm.
class ContactoForm extends BaseContactoForm {
    public function __construct() {
        parent::__construct();  // if there is a parent constructor
        $this->configure();
    }
    public function configure() {
        $this->addCSRFProtection(rand(1, 1000));
    }
}


The configure method is called from the __construct of the form. See the code.

@j0k yes, sfForm calls configure() in it's __construct, but without seeing the actual code from ContactoForm, we have no idea of __construct() is defined or not in that class which would prevent parent classes being called unless done explicitly so.

@Joe yep but usually you don't modify the __construct method in any sfForm and also, you don't modify Base*Form class because they are generated by Doctrine/Propel.
