Fixed comments

Author: wouterj

cookbook/security/csrf_in_login_form.rst

@@ -4,16 +4,16 @@
 Using CSRF in the Login Form
 ============================
 
-When using a login form, you should make sure that you are protected for CSRF
-(`Cross-site request forgery`_). The Security component already has build-in support
-form CSRF. In this article, you'll learn how you can use it in your login form.
+When using a login form, you should make sure that you are protected against CSRF
+(`Cross-site request forgery`_). The Security component already has built-in support
+for CSRF. In this article you'll learn how you can use it in your login form.
 
 Configuring CSRF
 ----------------
 
-At first, you have to configure the security component so it can use CSRF protection.
-The security component needs a CSRF provider. You can set this to use the default
-provider provided by the Form component:
+At first, you have to configure the Security component so it can use CSRF protection.
+The Security component needs a CSRF provider. You can set this to use the default
+provider available in the Form component:
 
 .. configuration-block::
 
@@ -70,8 +70,8 @@ Rendering the CSRF field
 Now the Security component checks for CSRF tokens, you have to add a *hidden* field
 to the login form containing the CSRF token. By default, this field is named as
 ``_csrf_token``. That hidden field has to contain the CSRF token, which can be generated
-by using the ``csrf_token`` function. That function requires a token ID, which is
-must be set to ``authenticate`` when using the login form:
+by using the ``csrf_token`` function. That function requires a token ID, which must
+be set to ``authenticate`` when using the login form:
 
 .. configuration-block::
 
@@ -105,11 +105,60 @@ must be set to ``authenticate`` when using the login form:
             <button type="submit">login</button>
         </form>
 
-After this, you have protected your login form for CSRF attacks.
+After this, you have protected your login form against CSRF attacks.
 
 .. tip::
 
-    You can change the name of the field by setting ``csrf_parameter`` and the token
-    ID by setting ``intention`` in your configuration.
+    You can change the name of the field by setting ``csrf_parameter`` and change
+    the token ID by setting ``intention`` in your configuration:
+
+    .. configuration-block::
+
+        .. code-block:: yaml
+
+            # app/config/security.yml
+            security:
+                firewalls:
+                    secured_area:
+                        # ...
+                        form_login:
+                            # ...
+                            csrf_parameter: _csrf_security_token
+                            intention: a_private_string
+
+        .. code-block:: xml
+
+            <!-- app/config/config.xml -->
+            <?xml version="1.0" encoding="UTF-8" ?>
+            <srv:container xmlns="http://symfony.com/schema/dic/security"
+                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                xmlns:srv="http://symfony.com/schema/dic/services"
+                xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd">
+
+                <config>
+                    <firewall name="secured_area">
+                        <!-- ... -->
+
+                        <form-login csrf-parameter="_csrf_security_token"
+                            intention="a_private_string" />
+                    </firewall>
+                </config>
+            </srv:container>
+
+        .. code-block:: php
+
+            // app/config/security.php
+            $container->loadFromExtension('security', array(
+                'firewalls' => array(
+                    'secured_area' => array(
+                        // ...
+                        'form_login' => array(
+                            // ...
+                            'csrf_parameter' => '_csrf_security_token',
+                            'intention'      => 'a_private_string',
+                        )
+                    )
+                )
+            ));
 
 .. _`Cross-site request forgery`: http://en.wikipedia.org/wiki/Cross-site_request_forgery