Introduction
Laravel makes it easy to protect your application from cross-site request forgery (CSRF) attacks. Cross-site request forgeries are a type of malicious exploit whereby unauthorized commands are performed on behalf of an authenticated user.
Laravel automatically generates a CSRF "token" for each active user session managed by the application. This token is used to verify that the authenticated user is the one actually making the requests to the application.
Anytime you define a HTML form in your application, you
should include a hidden CSRF token field in the form so
that the CSRF protection middleware can validate the
request. You may use the csrf_field helper
to generate the token field:
<form method="POST" action="/profile">
{{ csrf_field() }}
...
</form>
The VerifyCsrfToken middleware, which is
included in the web middleware group, will
automatically verify that the token in the request input
matches the token stored in the session.
Excluding URIs From CSRF Protection
Sometimes you may wish to exclude a set of URIs from CSRF protection. For example, if you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.
Typically, you should place these kinds of routes outside
of the web middleware group that the
RouteServiceProvider applies to all routes
in the routes/web.php file. However, you
may also exclude the routes by adding their URIs to the
$except property of the
VerifyCsrfToken middleware:
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
'stripe/*',
];
}
X-CSRF-TOKEN
In addition to checking for the CSRF token as a POST
parameter, the VerifyCsrfToken middleware
will also check for the X-CSRF-TOKEN
request header. You could, for example, store the token
in a HTML meta tag:
<meta name="csrf-token" content="{{ csrf_token() }}">
Then, once you have created the meta tag,
you can instruct a library like jQuery to automatically
add the token to all request headers. This provides
simple, convenient CSRF protection for your AJAX based
applications:
$.ajaxSetup({
headers: {
'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
}
});
X-XSRF-TOKEN
Laravel stores the current CSRF token in a
XSRF-TOKEN cookie that is included with
each response generated by the framework. You can use
the cookie value to set the X-XSRF-TOKEN
request header.
This cookie is primarily sent as a convenience since some
JavaScript frameworks, like Angular, automatically place
its value in the X-XSRF-TOKEN header.