Challenge 1 / 2

Your logout route requires the POST method, and you have CSRF enabled for logout (enable_csrf: true). What happens if you forget to pass the _csrf_token parameter and a user clicks "Logout"?

They’ll get a 405 Method Not Allowed error because CSRF only works with GET requests.

Symfony will automatically add the missing CSRF token into the form during rendering, so everything works.

The user won’t get logged out (the POST request happens, but Symfony rejects it because the token is missing/invalid).

The user will still be logged out because switching to a POST request is enough to stop CSRF attacks by itself.

Rewatch the video