What is the best way to check CSRF tokens?

Question

symfony

I think this is a simple question, and yet ... Somewhere I meet this option for checking CSRF tokens:

if (!$this->isCsrfTokenValid('delete', $request->request->get('token'))) {
            return new Response('Error');
        }

And somewhere like this (i.e. the object ID is added to the keyword):

if (!$this->isCsrfTokenValid('delete' . $entity->getId(), $request->request->get('token'))) {
            return new Response('Error');
        }

1. Which is more correct?
2. Do I need to specify the keyword even more, like not just `delete`, but `delete-image` for example?

Answer 1

Both ways are correct. It's just that the second one is more resistant to CSRF attacks. For example, the default form component uses the form class name for the field "intention" ("keyword" if you use your definition): https://github.com/symfony/form/blob/a0386553fabb5...
On the other hand, there is the opinion that the use of different tokens does not make the application more secure. See https://github.com/symfony/symfony/issues/18115
Personally, I use the first option i.e. one token for the entire application.