Security Issue: All forms are vulnerable to CSRF

[deanc]

Right now this is a security issue, as CSRF can occur.

You should consider moving decoupling all forms into an AbstractType and using the SF2 Form component.

One benefit of this is you can re-use forms elsewhere (and so can people who use the library). Also if you bump up the dependency to SF2.6 you can also use bootstrap form theme out the box, so the templates will also be a lot simpler.

[deanc]

Another issue that I stumbled upon today which could be solved by doing this, is that the custom profile fields are only available after account creation. In theory if the registration form were its own type, you could inject the $app object into the AbstractType for the registration form in the constructor, and therefore dynamically add some custom fields based on the available custom fields.