docs: update user guide

Author: kenjis

user_guide_src/source/changelogs/v4.1.5.rst

@@ -5,6 +5,12 @@ Release Date: Not released
 
 **4.1.5 release of CodeIgniter4**
 
+BREAKING:
+
+Fixed `a bug <https://github.com/codeigniter4/CodeIgniter4/issues/2913>`_ on CSRF protection.
+Now CSRF protection works on PUT/PATCH/DELETE requests when CSRF filter is applied.
+If you use such requests, you need to send CSRF token.
+
 Enhancements:
 
 - Added Cache config for reserved characters

user_guide_src/source/installation/upgrade_415.rst

@@ -53,3 +53,20 @@ The following methods and a property have been deprecated:
 - ``CodeIgniter\Router\RouteCollection``'s property ``$filterInfo``
 
 See *Applying Filters* in :doc:`Routing </incoming/routing>` for the functionality.
+
+**CSRF Protection**
+
+Because of a bug fix,
+now CSRF protection works on not only **POST** but also **PUT/PATCH/DELETE** requests when CSRF filter is applied.
+
+When you use **PUT/PATCH/DELETE** requests, you need to send CSRF token. Or remove the CSRF filter
+for such requests if you don't need CSRF protection for them.
+
+If you want the same behavior as the previous version, set the CSRF filter like the following in **app/Config/Filters.php**::
+
+    public $methods = [
+        'get'  => ['csrf'],
+        'post' => ['csrf'],
+    ];
+
+Protecting **GET** method needs only when you use ``form_open()`` auto-generation of CSRF field.

user_guide_src/source/libraries/security.rst

@@ -23,6 +23,9 @@ If you find a case where you do need direct access though, you may load it throu
 Cross-site request forgery (CSRF)
 *********************************
 
+.. warning:: The CSRF Protection is only available for **POST/PUT/PATCH/DELETE** requests.
+    Requests for other methods are not protected.
+
 Enable CSRF Protection
 ======================
 
@@ -54,6 +57,13 @@ Regular expressions are also supported (case-insensitive)::
         ],
     ];
 
+It is also possible to enable the CSRF filter only for specific methods::
+
+    public $methods = [
+        'get'  => ['csrf'],
+        'post' => ['csrf'],
+    ];
+
 HTML Forms
 ==========