How to POST a Laravel form with cURL from CLI? - laravel

Question

I have a laravel application with a form, where upon a GET request (example.my.lan/form) of the formular the user receives a *_session cookie and a XSRF-TOKEN cookie. Now I'm trying to call the controller (example.my.lan/form/confirmation) via POST on the command line with cURL:
curl -vvv -k -X POST -d "param1=value1&param2=value2" \
-H "Content-Type: application/x-www-form-urlencoded" \
--cookie "my_form_session=a...z" \
--cookie "XSRF-TOKEN=a...z" https://example.my.lan/form/confirmation
curl -vvv -k -X POST -d "param1=value1&param2=value2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "my_form_session=a...z" \
-H "XSRF-TOKEN=a...z" https://example.my.lan/form/confirmation
curl -vvv -k -X POST -d "param1=value1&param2=value2" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "my_form_session: a...z" \
-H "XSRF-TOKEN: a...z" https://example.my.lan/form/confirmation
From my browser everything works as expected. But if I call the controller on the CLI using cURL, the laravel app is always responding with a 419 (The page has expired). I know this is some cookie related issue, but still can't figure ou how to solve it - maybe someone has an idea?

Answer 1

So roughly speaking here's what needs to happen:
You need to perform an initial request to get a valid session cookie (which is essentially an encrypted session id) and along with that you also need to somehow obtain a valid CSRF token.
To get the token you have two options.
Visit a page which has a form which includes it via #csrf
Grab the cookie called XSRF-TOKEN which contains the encrypted csrf token
When you send the request you need to be sure you send the correct session cookie e.g. --cookie "my_form_session=a...z".
If you got the token from the #csrf field then you either send the header X-CSRF-TOKEN or as an additional form field _token=csrftoken
If you got the token from the XSRF-TOKEN cookie, which contains an encrypted CSRF token, this needs to go in the X-XSRF-TOKEN field.
By convention, all non-standard HTTP headers should be prefixed with X- (indicating an extension to the protocol) which is why those headers start with X-