Add explicit value for csrf_protection.enabled when adding stateless_token_ids

[unicolored]

Q	A
License	MIT

Hello,

I had the recipe adding stateless_token_ids. I thought that csrf_protection will be enabled by default. But debug:config showed me that csrf_protection.enabled is null by default.

The current documentation does not explicitly mention that one should add enable: true when using the stateless_token_ids: https://symfony.com/doc/current/security/csrf.html#stateless-csrf-tokens

So I thought to add enable: true by default, to be coherent with the comment of the recipe: # Enable stateless CSRF protection for forms and logins/logouts.

I hope this is correct.

[github-actions]

Thanks for the PR 😍

How to test these changes in your application

1. Define the SYMFONY_ENDPOINT environment variable:

   # On Unix-like (BSD, Linux and macOS)
   export SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1453/index.json
   # On Windows
   SET SYMFONY_ENDPOINT=https://raw.githubusercontent.com/symfony/recipes/flex/pull-1453/index.json

2. Install the package(s) related to this recipe:

   composer req symfony/flex
   composer req 'symfony/form:^7.2'

3. Don't forget to unset the SYMFONY_ENDPOINT environment variable when done:

   # On Unix-like (BSD, Linux and macOS)
   unset SYMFONY_ENDPOINT
   # On Windows
   SET SYMFONY_ENDPOINT=

Diff between recipe versions

In order to help with the review stage, I'm in charge of computing the diff between the various versions of patched recipes.
I'm going keep this comment up to date with any updates of the attached patch.

[nicolas-grekas]

This shouldn't be needed, this logic should ensure that defining stateless_token_ids is enough:
https://github.com/symfony/symfony/blob/ce5448818410c279a1274f29bb820fc097150262/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php#L558-L561

Did you experience any issue?

[unicolored]

Indeed, it works fine this morning, when i omit enable: true.
Tests are now green on different scenarios: using symfony server, using DDEV, behind proxy in prod.
Probably i was confused by incorrect setup of trusted proxies.

Thanks for your explanation.