[Security] check token in payload instead just request

[eltharin]

Q	A
Branch?	7.1
Bug fix?	yes
New feature?	no
Deprecations?	no
License	MIT

Replace request by getPayload for allow token to ba passed in Json for an API call

[carsonbot]

Hey!

Thanks for your PR. You are targeting branch "7.2" but it seems your PR description refers to branch "7.1".
Could you update the PR description or change target branch? This helps core maintainers a lot.

Cheers!

Carsonbot

[xabbuh]

As this is not a bugfix this PR must target the ’7.2` branch.

[eltharin]

If you look the documentation for 7.1 it's written the attribute is alternative to $submittedToken = $request->getPayload()->get('token'); but it's not really
So It's a bug not a new feature.
https://symfony.com/doc/current/security/csrf.html#generating-and-checking-csrf-tokens-manually

[xabbuh]

That’s a bug in the documentation (caused by symfony/symfony-docs#19225) and needs to be fixed there.

[eltharin]

no need to fix the fake bug in documentation since the real bug is fixed. One moire time it's not a new feature

[nicolas-grekas]

I understand both pov, strictly speaking this is a feature, but since this class has been introduced in 7.1 #52961 by @yguedidi, it might be fine being a bit more relaxed here, afterall this might just be something we missed. Bonus: that'd make the doc simpler :)

[fabpot]

Thank you @eltharin.