Info about implicit session start

[ThomasLandauer]

This should be explained somewhere (took me a while to figure it out). If this is not the right place (or format), please go ahead and correct it!

[xabbuh]

I think it's a good idea to explain it here. Though I would rather put it in a caution block to make it more visible:

.. caution::
    Since the token is stored [...]

[ThomasLandauer]

OK, sure! Would you help me?
I don't have that much knowledge, just wanted to raise the attention of somebody to this issue. There are several related questions on Stackoverflow, e.g. http://stackoverflow.com/questions/26778786/symfony2-failed-to-start-the-session-already-started-by-php/
but the interplay between session and forms is documented nowhere.

On http://symfony.com/doc/current/components/http_foundation/sessions.html it says: "While it is recommended to explicitly start a session,...", this didn't work for me when using a form. So the open questions are:

• What's the exact benefit of starting a session explicitly?
• Do forms use Symfony's sessions or PHP's native sessions?
• How can you see the CSRF token in the session? Should probably be in the Attributes Bag, but I can't see it there.
  And a code example of the recommended way to do it would really be nice!

Cheers,
Thomas

[xabbuh]

Oh, it's quite easy. Just replace the paragraph you added with the following markup:

.. caution::

    Since the token is stored in the session, a session is started automatically
    as soon as you render a form with CSRF protection.

That's it. :)

[xabbuh]

👍

[xabbuh]

Thank you Thomas.