🇫🇷 Free practice test question from: CSRF (PHP Symfony)

Symfony’s CSRF mechanism does not store tokens in a database; instead, it uses a token generated dynamically for the specific intention (an arbitrary string used to identify the token). https://symfony.com/doc/current/reference/twig_reference.html#csrf-token #for more information

→ CSRF tokens in Symfony are not tied to specific user sessions, making them usable for anonymous forms as well
→ While some systems use headers for CSRF tokens, Symfony’s default CSRF protection relies on form fields, not request headers

The key point is that Symfony's CSRF protection is stateless - it doesn't need to store tokens anywhere because it can regenerate the expected token using the intention and secret key.