Add extension to globally disable csrf protection when it is turned off

src/Sylius/Bundle/CoreBundle/Form/Extension/DisabledCsrfProtectionFormExtension.php

@@ -0,0 +1,43 @@
+<?php
+
+/*
+ * This file is part of the Sylius package.
+ *
+ * (c) Sylius Sp. z o.o.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace Sylius\Bundle\CoreBundle\Form\Extension;
+
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\Form\AbstractTypeExtension;
+use Symfony\Component\Form\Extension\Core\Type\FormType;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+final class DisabledCsrfProtectionFormExtension extends AbstractTypeExtension
+{
+    public function __construct(
+        private readonly ContainerInterface $container,
+    ) {
+    }
+
+    public static function getExtendedTypes(): iterable
+    {
+        return [FormType::class];
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $csrfEnabled = $this->container->hasParameter('form.type_extension.csrf.enabled')
+            ? $this->container->getParameter('form.type_extension.csrf.enabled')
+            : true;
+
+        if (!$csrfEnabled) {
+            $resolver->setDefault('csrf_protection', false);
+        }
+    }
+}

src/Sylius/Bundle/CoreBundle/Resources/config/services/form.php

@@ -26,6 +26,7 @@ use Sylius\Bundle\CoreBundle\Form\Extension\CartItemTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\CartTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\CatalogPromotionTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\ChannelTypeExtension;
+use Sylius\Bundle\CoreBundle\Form\Extension\DisabledCsrfProtectionFormExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\OrderTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\PaymentMethodTypeExtension;
 use Sylius\Bundle\CoreBundle\Form\Extension\ProductTranslationTypeExtension;
@@ -181,6 +182,12 @@ return static function (ContainerConfigurator $container) {
         ->tag('form.type_extension', ['priority' => 100])
     ;
 
+    $services
+        ->set('sylius.form.extension.type.disabled_csrf_protection', DisabledCsrfProtectionFormExtension::class)
+        ->args([service('service_container')])
+        ->tag('form.type_extension', ['priority' => 100])
+    ;
+
     $services
         ->set('sylius.form.type.product_review', ProductReviewType::class)
         ->args([