Laravel routing and CSRF protection

Question

If I have this line of code in my routes.php file:

Route::when('*', 'csrf', array('post', 'put', 'patch', 'delete'));

Do I still need to do this?

Route::group(array('before' => 'csrf'), function() {
    Route::post('/search', array(
        'as' => 'search-post',
        'uses' => 'SearchController@postSearch'
    ));
});

Or is it ok to just do this?

Route::post('/search', array(
    'as' => 'search-post',
    'uses' => 'SearchController@postSearch'
));

How can I check it it's working though? I'm not familiar with CSRF protection. — Howard
– Howard, Commented Jan 13, 2015 at 20:26
Remove the CSRF token from your form, submit it and check if you get an error. It SHOULD throw an Exception. — MisterBla
– MisterBla, Commented Jan 13, 2015 at 20:27
@rotaercz In your browser's dev tools, change the value of the input type="hidden" name="_token" field. — ceejayoz
– ceejayoz, Commented Jan 13, 2015 at 20:27

lukasgeiter · Accepted Answer · 2015-01-13 20:31:44Z

3

Route::when filters (internally called pattern filters) are called right before before filters. You're all good with just using your routes normally.

Here's the relevant source code:

public function callRouteBefore($route, $request)
{
    $response = $this->callPatternFilters($route, $request);

    return $response ?: $this->callAttachedBefores($route, $request);
}

As you can see first the pattern filters will be called. If they return any response it will be returned from here, otherwise the "normal" before filters will be called.

answered Jan 13, 2015 at 20:31

lukasgeiter

154k29 gold badges349 silver badges280 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Howard Over a year ago

You answer a lot of my questions and I'd like to say thanks publicly. When I launch the site there's going to a be a shout out section. I'd like to thank you in there. Shall I add you as lukasgeiter or would you like me to put your name there?

lukasgeiter Over a year ago

You're very welcome :) Well "lukasgeiter" is actually my name. You can write it "Lukas Geiter" if you prefer ;)

Howard Over a year ago

Will do and I'll send you a link! :)

rdiz · Accepted Answer · 2015-01-13 20:29:24Z

2

Yes; you should be safe with just Route::post('/search', [...]);.

answered Jan 13, 2015 at 20:29

rdiz

6,1961 gold badge31 silver badges41 bronze badges

Collectives™ on Stack Overflow

Laravel routing and CSRF protection

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related