Post Link

A link submitted as a form, with optional HTTP method spoofing, CSRF protection, and a confirmation prompt.

<twig:PostLink href="/link/newsletter/subscribe" class="…rounded-md bg-violet-600 px-4 py-2 text-sm font-medium text-white hover:bg-violet-500">
    Subscribe
</twig:PostLink>

Installation

php bin/console ux:install post-link --kit common

Install the following Composer dependencies:

composer require symfony/security-csrf

Copy the following file(s) into your app:

{# @prop href string The URL the form submits to. #}
{# @prop csrfTokenId string|null The CSRF token ID used to generate the hidden token field; when null, no token is added. #}
{# @prop method string The HTTP method used to submit the form; when not `POST`, a hidden `_method` field is added for method spoofing. #}
{# @prop confirm string|null A confirmation message shown before submitting; when null, no confirmation is required. #}
{# @block content The button label. #}
{% props href, csrfTokenId = null, method = &#039;POST&#039;, confirm = null %}

&lt;form{{ attributes.nested(&#039;form&#039;).defaults({
    action: href,
    method: &#039;post&#039;,
    class: &#039;inline&#039;,
    onsubmit: confirm ? &#039;return confirm(&#039; ~ confirm|json_encode ~ &#039;)&#039; : false,
}) }}&gt;
    {% if method|upper != &#039;POST&#039; %}
        &lt;input type=&quot;hidden&quot; name=&quot;_method&quot; value=&quot;{{ method|upper }}&quot;&gt;
    {% endif %}
    {% if csrfTokenId %}
        &lt;input{{ attributes.nested(&#039;csrf&#039;).defaults({
            type: &#039;hidden&#039;,
            name: &#039;_csrf_token&#039;,
            &#039;data-controller&#039;: &#039;csrf-protection&#039;,
            value: csrf_token(csrfTokenId),
        }) }}&gt;
    {% endif %}
    &lt;button{{ attributes.defaults({type: &#039;submit&#039;}) }}&gt;
        {% block content %}{% endblock %}
    &lt;/button&gt;
&lt;/form&gt;

Usage

<twig:PostLink href="/posts/42/publish">
    Publish
</twig:PostLink>

Examples

Custom Method

Set the method prop to submit the form with a spoofed HTTP method. A hidden _method field is added so Symfony can route the request to the matching controller.

Warning

Method spoofing only works when HTTP method override is enabled in your Symfony app. Set framework.http_method_override: true in config/packages/framework.yaml.

<twig:PostLink href="/link/posts/42" method="DELETE" class="…rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white hover:bg-red-500">
    Delete post
</twig:PostLink>

With Confirmation

Pass a confirm message to prompt the user with a native confirmation dialog before the form is submitted.

<twig:PostLink href="/link/posts/42/delete" confirm="Are you sure you want to delete this post?" class="…rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white hover:bg-red-500">
    Delete post
</twig:PostLink>

With CSRF Protection

Set csrfTokenId to add a hidden CSRF token field, protecting the form against cross-site request forgery.

<twig:PostLink href="/link/posts/42/delete" csrfTokenId="delete-post" class="…rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white hover:bg-red-500">
    Delete post
</twig:PostLink>

API Reference

`<twig:PostLink>`

Prop	Type	Default
`href`	`string`	-
`csrfTokenId`	`string\|null`	`null`
`method`	`string`	`'POST'`
`confirm`	`string\|null`	`null`

Block	Description
`content`	The button label.