<p dir="auto">If form is sent with an invalid CSRF token, this error message will be displayed: <code class="notranslate">The CSRF token is invalid. Please try to resubmit the form.</code></p>
<p dir="auto">This message is in fact instruction on how to bypass CSRF protection. This wording makes protection to be more like an attacker collaborator ;-)</p>
<p dir="auto">Please change message to something like <code class="notranslate">Your session has expired. Please return to the home page and try again.</code>.</p>
<p dir="auto">I don't think the current behavior for specifying a null errorPath option for the UniqueEntity validator makes sense.</p>
<p dir="auto">When passing null to this option, the error should appear on the object itself, not on the first field provided to the fields option.   Perhaps if the errorPath option is not set,  then it could appear on the first field provided.</p>
<p dir="auto">My use case is as follows.  Say I have an object called PriceRule.   This object contains several relations to other objects, and is used to calculate a price when a Company is posting a job.  The object as a whole should be unique so duplicate rules aren't created.   It looks like this:</p>
<div class="highlight highlight-text-html-php notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="&lt;?php

/**
 * @UniqueEntity(fields={&quot;company&quot;, &quot;occupation&quot;, &quot;specialty&quot;}, ignoreNull=false})
 */
class PriceRule
{
    public $company;
    public $occupation;
    public $specialty;
    public $price;
}"><pre class="notranslate"><span class="pl-ent">&lt;?php</span>

<span class="pl-c">/**</span>
<span class="pl-c"> * @UniqueEntity(fields={"company", "occupation", "specialty"}, ignoreNull=false})</span>
<span class="pl-c"> */</span>
<span class="pl-k">class</span> <span class="pl-v">PriceRule</span>
{
    <span class="pl-k">public</span> <span class="pl-c1"><span class="pl-c1">$</span>company</span>;
    <span class="pl-k">public</span> <span class="pl-c1"><span class="pl-c1">$</span>occupation</span>;
    <span class="pl-k">public</span> <span class="pl-c1"><span class="pl-c1">$</span>specialty</span>;
    <span class="pl-k">public</span> <span class="pl-c1"><span class="pl-c1">$</span>price</span>;
}</pre></div>
<p dir="auto">If you create a PriceRule object with a duplicate company, occupation and specialty data, it makes no sense for the error to appear on any of these individual fields.   The error should appear on the root of the object, but with the current UniqueEntity validator this does not seem to be possible.</p>
<p dir="auto">In short, I think that specifying a errorPath=null explicity should result in the <code class="notranslate">addViolation</code> method being called on the context, and if the errorPath is left out, it should result in a violation being added at the first field, which is the current behavior.</p>
<p dir="auto">Thoughts?</p>