Laravel 5: POST without CSRF check

Question

It seems that Laravel 5 by default applies the CSRF filter to all requests without a request. This is normal for a POST form, but it can be a problem for an API that sends DELETE, etc.

Simple question:

How to set a POST route without CSRF protection?

Answer 1

Go to app/Http/Middleware/VerifyCsrfToken.php and then enter your routes (for which you want to disable the csrf token) in the $ except array.

eg:

 class VerifyCsrfToken extends BaseVerifier { protected $except = [ '/register' ]; } 

Answer 2

You can exclude URIs from CSRF by simply adding them to the $except property of the VerifyCsrfToken (app / Http / Middleware / VerifyCsrfToken.php):

 <?php namespace App\Http\Middleware; use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier; class VerifyCsrfToken extends BaseVerifier { /** * The URIs that should be excluded from CSRF verification. * * @var array */ protected $except = [ 'api/*', ]; } 

Documentation: http://laravel.com/docs/5.1/routing#csrf-protection

Answer 3

My hack problem:

CSRF is now "middleware" registered globally at App\Http\Kernel.php . When you delete it, CSRF protection will not be enabled by default (Laravel4 behavior).

To enable it in the route:

• Create a short key in the application / Providers / RouteServiceProvider.php:

   protected $middleware = [ // .... 'csrf' => 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken', ]; 

• Now you can enable it for any route:

   $router->post('url', ['middleware' => 'csrf', function() { ... }]); 

Not the most elegant IMO solution ...

Answer 4

just listen to it. Only before 30 minutes did I encounter the same problem. Now he has decided. just try this.

Goto App → HTTP-> Kernel

open the kernel file.

there you can see: \ App \ Http \ Middleware \ VerifyCsrfToken :: class,

just disable this specific code using //

It! It will work!

So that you can remove the middleware from the API call (if you want it).