# How to Configure the Session Container for all CSRF Validators/Elements

**URL:** <https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859>\
**Category:** Components & MVC\
**Tags:** laminas-form, laminas-mvc, laminas-validator, laminas-session\
**Created:** [April 27, 2022, 1:33pm UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859 "2022-04-27T13:33:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![FalkHe](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/falkhe/32/1296_2.png) [@FalkHe](https://discourse.laminas.dev/u/FalkHe)\
**Post date:** [April 27, 2022, 1:33pm UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/1 "2022-04-27T13:33:28Z")

</div>

Hi

I have a Laminas MVC (v3) Application and noticed a serious issue with the CSRF Validation.

While starting to run this application on more than on PHP Server in parallel, all CSRF Validations failed to 50% … makes sense so far, because i didn’t configure the session storage and therefor used the native Savehandler. This, of cause, only works in a single-server environment.

Solution felt easy: I set up a different SaveHandler via [this Documentation](https://docs.laminas.dev/laminas-session/application-integration/usage-in-a-laminas-mvc-application/) that stores the session data in a central Redis instance. So far, so good.

**BUT:** The CSRF Validator doesn’t use this Configuration unless i specify the Container (option ‘session’) to each and every CSRF Validator (or Element) manually. 😕 As I’m using shorthand configuration (see below), this would be a pain in the A\*\* to change all the Forms and provide specific instanciated Elements/Validators.

Is there a way to tell the application to always use the configured Session Container. I would like to use the correct (“global”) Session Container / Config without touching every single Form.

Form example:

```php
class SignUpForm extends \Laminas\Form\Form
{
    public function init()
    {
        $this->add([
            'type' => Element\Email::class, // Custom Form Element
        ]);
        $this->add([
            'type' => Element\FirstName::class, // Custom Form Element
        ]);
        $this->add([
            'type' => Element\LastName::class, // Custom Form Element
        ]);
        $this->add([
            'type' => Csrf::class, // \Laminas\Form\Element\Csrf
            'name' => 'csrf',
        ]);
    }
}

```

thanks in advance  
F4lkH3

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [April 27, 2022, 6:55pm UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/2 "2022-04-27T18:55:21Z")

</div>

Hello and welcome to our forums! 😃

> [@FalkHe](#):
>
> Is there a way to tell the application to always use the configured Session Container.

You can create a factory for the form element `Csrf`. Here is an example:

```php
namespace ExampleModule\Form;

use Laminas\Form\Element\Csrf;
use Laminas\Session\Container as SessionContainer;
use Psr\Container\ContainerInterface;

final class CsrfFactory
{
    public function __invoke(ContainerInterface $container): Csrf
    {
        /** @var SessionContainer $sessionContainer */
        $sessionContainer = $container->get(SessionContainer::class);

        $element = new Csrf();
        $element->setCsrfValidatorOptions(
            [
                'session' => $sessionContainer,
            ]
        );

        return $element;
    }
}

```

Then extend the configuration and use the new factory for the existing form element. Example:

```php
return [
    'form_elements' => [
        'factories' => [
            Laminas\Form\Element\Csrf::class => ExampleModule\Form\CsrfFactory::class,
        ],
    ],
    // …
];

```

Caution: There is a problem with this example and the current version of laminas-form, because if the option `csrf_options` is used for the element `Csrf` in a form class, the session container is overwritten!

* * *

If I think of something else or better, I will add it here.

---

<div class="post-metadata">

**Author:** ![FalkHe](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/falkhe/32/1296_2.png) [@FalkHe](https://discourse.laminas.dev/u/FalkHe)\
**Post date:** [April 28, 2022, 9:59am UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/3 "2022-04-28T09:59:21Z")

</div>

> [@froschdesign](#):
>
> ```auto
> return [
> 'form_elements' => [/**/]
> ];
> 
> ```

Thanks! Obvious … ^

OT: I always stumble over these PluginManagers. Not quiet transparent, when the ServiceManager is used and when a speicific PluginManager, imho. 😕

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [April 28, 2022, 10:28am UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/4 "2022-04-28T10:28:48Z")

</div>

> [@FalkHe](#):
>
> Not quiet transparent, when the ServiceManager is used and when a speicific PluginManager, imho.

It is always the same: if there are already objects/plugins like validators, filters, form elements, controller plugins, hydrators, cache storage adapters, translation loaders, view helpers, feed extensions, input filters, etc. then a [plugin manager](https://docs.laminas.dev/laminas-servicemanager/plugin-managers/) is used.  
This means that the service container of your application is not used for these plugins, because most components can be used as stand-alone and you do not have a _global_ service container there.

If you do not know or do not find the correct configuration key to register custom plugins then check the factory of the related plugin manager of the component. Here are some examples:

> <https://github.com/laminas/laminas-inputfilter/blob/2.14.x/src/InputFilterPluginManagerFactory.php#L44>

> <https://github.com/laminas/laminas-hydrator/blob/4.4.x/src/HydratorPluginManagerFactory.php#L58>

> <https://github.com/laminas/laminas-i18n/blob/2.16.x/src/Translator/LoaderPluginManagerFactory.php#L47>

> <https://github.com/laminas/laminas-paginator/blob/27248add16ca93b87e59ef0bfa317ec2495c021d/src/AdapterPluginManagerFactory.php#L37>

And in a laminas-mvc based or Mezzio based application you can fetch a registered plugin manager from the application service container, like in laminas-form: [Usage in a laminas-mvc application - laminas-form - Laminas Docs](https://docs.laminas.dev/laminas-form/v3/application-integration/usage-in-a-laminas-mvc-application/#create-factory-for-controller)

Check also [Advanced Use Cases - laminas-form - Laminas Docs](https://docs.laminas.dev/laminas-form/v3/advanced/#creating-custom-elements)

---

<div class="post-metadata">

**Author:** ![ocramius](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/ocramius/32/23_2.png) [@ocramius](https://discourse.laminas.dev/u/ocramius)\
**Post date:** [April 28, 2022, 11:12am UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/5 "2022-04-28T11:12:15Z")

</div>

> > |   
> > |
> > 
> > - | - |
> 
> OT: I always stumble over these PluginManagers. Not quiet transparent, when the ServiceManager is used and when a speicific PluginManager, imho. ![:confused:](https://emoji.discourse-cdn.com/twitter/confused.png?v=12 ":confused:")
> 
> * * *

Agreed, this was initially done to scope the various services, but ultimately, it mostly led to a lot of confusion for most users.

This is something that the Laminas TSC should certainly discuss in future, to come up with a better design, especially now that PSR-11 is more popular.

---

<div class="post-metadata">

**Author:** ![froschdesign](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/froschdesign/32/38_2.png) [@froschdesign](https://discourse.laminas.dev/u/froschdesign)\
**Post date:** [April 28, 2022, 11:28am UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/6 "2022-04-28T11:28:44Z")

</div>

> [@ocramius](#):
>
> Agreed, this was initially done to scope the various services, but ultimately, it mostly led to a lot of confusion for most users.

Unfortunately, it was never documented either, especially that it is the same thing over and over again and can be used the same way. This means that the _big picture_ is missing for the user.

---

<div class="post-metadata">

**Author:** ![Tyrsson](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/tyrsson/32/1664_2.png) [@Tyrsson](https://discourse.laminas.dev/u/Tyrsson)\
**Post date:** [May 9, 2022, 12:21am UTC](https://discourse.laminas.dev/t/how-to-configure-the-session-container-for-all-csrf-validators-elements/2859/7 "2022-05-09T00:21:24Z")

</div>

> [@froschdesign](#):
>
> Unfortunately, it was never documented either, especially that it is the same thing over and over again and can be used the same way. This means that the _big picture_ is missing for the user.

As someone that is relatively new to Laminas. This was one of the main hurdles. I actually wrote my own plugin manager just to learn exactly how they functioned and why. Now, that I understand them, it makes perfect sense. When you’re new and first trying to get your head around it… An in-depth look into the how and why would have been wonderful.