Laravel makes it easy to protect your application from cross-site request forgery (CSRF) attacks. CSRF are a type of malicious exploit whereby unauthorized commands are performed on behalf of an authenticated user. Please see this documentation for more details. Laravel automatically generates a CSRF “token” for each active user session managed by the application. This token is used to verify that the authenticated user is the one actually making the requests to the application.
Any HTML forms pointing to POST, PUT, or DELETE routes that are defined in the web routes file should include a CSRF token field. This is by default in Laravel.
In Laravel, you can generate csrf token in blade file using the following syntax.
If you only want the value of the csrf token, you can generate it by writing:
{{ csrf_token() }}
which generates the token value like this: 7YC0Sxth7AYe4RFSjzaPf2ygLCecJhPbyXhz6vvF
If you are using forms, you can add the following line of code inside the form:
{{ csrf_field() }}
Example Scenario
In some case scenarios, where you use external services, you need to disable this feature. In my case, I was using a NIBL payment gateway. After transaction completion, gateway redirect to my specified url with if parameters. But, there was not any csrf token specified. Thus, I had to disable the check for that route. You may have came across such case. I will explain how to disable it for specific urls.
Disable CSRF
There is a middleware VerifyCsrfToken.php inside app/Middleware. Open the file and there is a array property named $except. Simply add your routes inside that array and you are done 🙂
 attacks. There is a middleware VerifyCsrfToken.php inside app/Middleware. Open the file and there is a array property named $except. Simply add your routes inside that array and you are done){kind=link}