// in formtype public function setDefaultOptions(OptionsResolverInterface $resolver) { $resolver->setDefaults(array( 'data_class' => Entity::class, 'csrf_protection' => true, 'intention' => 'entity_item_intention', )); } // in twig <input type="hidden" name="token" value="{{ csrf_token(form_instance.vars.name) }}"> // in controller $token = $request->get('token') $this->get('security.csrf.token_manager')->isTokenValid(new CsrfToken($formTypeInstance->getName(), $token));