I'm trying to exclude all requests on an endpoint which I call test.com/code so I do like this in the VerifyCsrfToken.php file.
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
class VerifyCsrfToken extends Middleware
{
/**
* Indicates whether the XSRF-TOKEN cookie should be set on the response.
*
* #var bool
*/
protected $addHttpCookie = true;
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
'code',
'code/*'
];
}
But it does not solve the issue, even after I try to run "php artisan route:clear && php artisan config:clear", Anyone knows why I can't exclude specific routes? (Laravel 5.8)
My route is something like this:
Route::get('code/testing', 'CodeController#testing');
I have try this and it didn't work either.
protected $except = [
'https://test.com/code/*',
];
Till now the only way I figure out is remove the line "\App\Http\Middleware\VerifyCsrfToken::class," from app/Http/Kernel.php to disable Csrf feature which is not a good solution.
Use / (slash) at the beggining :
protected $except = [
'/code/*'
];
You can try '/code/*'. It works for me with a slash / in the front of the url.
Related
I used to run debug true in production when needed with Laravel 5 the following way:
'debug' => env('APP_DEBUG', $_SERVER['REMOTE_ADDR'] == 'myipaddress' ? true : false),
However Laravel 6 doesn't let me use it, when I do artisan config:cache, artisan complains that:
variable $_server['REMOTE_ADDR'] is not defined and exists.
Is there another way someone has found out to be working to do this with Laravel 6?
You can't cache dynamic configs. there is no request and no $_server when Laravel tries to cache your configs.
You must disable your debug on production (APP_DEBUG = false) and check the log for any errors.
But if you insist to enable app debug dynamically, you can use middleware:
Create a new middleware using Artisan command:
php artisan make:middleware EnableDebug
This command will place a new EnableDebug class within your app/Http/Middleware directory. Modify it like this:
<?php
namespace App\Http\Middleware;
use Closure;
class EnableDebug
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle($request, Closure $next)
{
config(['app.debug' => $request->ip() === 'myipaddress']);
return $next($request);
}
}
List your middleware class at the end of the $middleware property of your app/Http/Kernel.php class:
protected $middleware = [
//...
\App\Http\Middleware\EnableDebug::class,
];
I am trying to use this package, which does everything I want. So indeed everything seems to work except for when I upload my image.
It's not going to UtilsController#uploadfile function at all.
Route::post('/uploadfile', 'UtilsController#uploadfile');
public function uploadfile(Request $request){
$img = $request->img;
$newlocation = $request->newlocation;
$filename = $request->filename;
return file_put_contents ($newlocation . "/" . $filename , $img );
}
But when I inspect the network, everything seems to be OK...
And I get this error: 419 unknown status
Any idea?
Sometimes there may be situations where on which we may want to have routes to exist without requiring the CSRF_TOKEN. We can simply add those URIs or routes in VerifyCsrfToken middleware's except array like this
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
class VerifyCsrfToken extends Middleware
{
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
'stripe/*',
'http://example.com/foo/bar',
'http://example.com/foo/*',
];
}
I would like to know if there's a way I can programmatically add route to $except variable in VerifyCsrfToken class.
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
//
];
}
I am developing a package that listens to webhooks/postback from a payment gateway. It would be nicer if my custom route would be added to $except variable upon installation of the package.
Thanks
I decided to add my custom route to api.php
file_put_contents(
base_path('routes/api.php'),
file_get_contents(__DIR__.'/stubs/make/routes.stub'),
FILE_APPEND
);
VerifyCsrfToken middleware does not intercept routes in api.php
I want to call my functions from android side.
now, I want to send post values from android side.
How can I disable csrf token for some functions ?
because without it I got error message .
like this:
Route::post('mobile/android/getlastnews','NewsController#getLastNews');
For Laravel 5.2, inside app/Http/Middleware/VerifyCsrfToken.php you just need to add it to the $except array.
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
'mobile/android/getlastnews'
];
}
If you wanted to allow all routes for mobile/ you can do the following
protected $except = [
'mobile/*'
];
Open app/Http/Middleware/VerifyCsrfToken.php and in the protected $except = []; array add your URL that you want to be skipped for CSRF validation.
I want to see how I can disable CSRF token in Laravel and where I have to disable it. Is this good to disable it or not?
You can Disable CSRF on few routes by editing.
App\Http\Middleware\VerifyCsrfToken
and add your own routes name in protected
$except = [] array.
It does not seems to be good practice as by doing this we are removing security feature of Laravel.
In laravel 9.
Open file \App\Http\Middleware\VerifyCsrfToken.php
Disable for all routes
protected $except = [
'*',
];
Disable for some routes
protected $except = [
'mobile/*',
'news/articles',
];
I searched for a long time how to disable CSRF completely, there are many identical examples but they do not help
Many people explain how to do it, but they do not explain what the url should look like.
edit app/Http/Middleware/VerifyCsrfToken.php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
class VerifyCsrfToken extends Middleware
{
/**
* Indicates whether the XSRF-TOKEN cookie should be set on the response.
*
* #var bool
*/
protected $addHttpCookie = true;
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
'/user/my_function'
];
}
In the $except array(); we add a url with just a simple string. This points to a controller usually depending on how your route is setup.
For example I have a UserController.php file in my Controller folder. I have a route like. In the web.php routes file.
Route::post('/user', 'UserController#my_function')->name('my_function');
Also alternatively, if you came to this question simply because you don't know how to use the CSRF and you don't actually need to disable it, or make the URL except. You can use this method.
Add these lines to your app.blade.php if it is used for ajax related calls.
<script>
$(function() {
$.ajaxSetup({
headers: {
'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content')
}
});
});
</script>
You can disable it in app/http/Kernel.php in the web middleware group.
Is this good to disable it or not?
No it's not. Read the Wikipedia page about CSRF to understand what CSRF is, the CSRF-Token prevents CSRF.
The CSRF token protects your application and it's users against cross-site request forgery. For more information on that, have a read here:
https://en.wikipedia.org/wiki/Cross-site_request_forgery
The token is validated via Middleware in Laravel. If you take a look at the file app/Http/Middleware/VerifyCsrfToken.php, you will see it gives you the option to add URLs that should be exempt from CSRF verification.
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
//
];
}
If you want to disable it entirely, you can find it in the Middleware group named web in app/Http/Kernel.php. Those are the middlewares that fire by default over HTTP requests.
I wouldn't recommend disabling it where possible though.
Hi just go to app/Http/Kernel.php file simply commented out line no 31
// \App\Http\Middleware\VerifyCsrfToken::class,
If you want to block csrf token verification easily head over to app/Middleware/VerifyCsrfToken.php to disable it for all routes
protected $except = ['*'];
or specify routes like this
protected $except = ['/api/route/one', 'api/route/two'];
(Temporary fix. Not Recommended)
Just Open kernel.php (app/http)
and disable
App\Http\Middleware\VerifyCsrfToken::class,