# see https://symfony.com/doc/current/reference/configuration/framework.html
framework:
    secret: '%env(APP_SECRET)%'

    # Note that the session will be started ONLY if you read or write from it.
    session: true

    form:
        csrf_protection:
            # Symfony defaults this to {data-controller: csrf-protection}, which only made sense
            # while the stateless CSRF Stimulus controller existed. We use plain session-backed
            # tokens, so the hidden field needs no attributes at all.
            field_attr: {}

    #esi: true
    #fragments: true

when@test:
    framework:
        test: true
        session:
            storage_factory_id: session.storage.factory.mock_file