Menu
LARAVEL

Laravel User CSRF protection


CSRF (Cross-Site Request Forgery) protection is an important security feature in web applications, including those built with Laravel. Laravel provides built-in CSRF protection out of the box. Here's how CSRF protection works in Laravel.

 

CSRF Token Generation

When a user visits your Laravel application for the first time, Laravel generates a CSRF token for the user's session. This token is typically stored in a session variable.

 

CSRF Token Verification

 With each form submission or AJAX request that modifies state (POST, PUT, DELETE requests), Laravel expects a CSRF token to be included in the request. This token is typically added to the form as a hidden field or included in the request headers.

 

CSRF Comparison and Validation

When Laravel receives a request, it compares the CSRF token included in the request with the token stored in the user's session. If the tokens match, the request is allowed to proceed. If not, Laravel rejects the request, protecting the application from CSRF attacks.

 

To enable CSRF protection in Laravel, you don't need to do much as it's enabled by default. Laravel automatically generates CSRF tokens for each active user session and verifies them on incoming requests.

 

1. Forms:

When using forms to submit data, Laravel provides a @csrf Blade directive that you can include in your forms. This directive generates an HTML <input> field containing the CSRF token.

<form method="POST" action="/your-route">
    @csrf
    <!-- Other form fields -->
</form>

 

2. AJAX Requests:

 When making AJAX requests, you need to ensure that the CSRF token is included in the request headers. Laravel provides a convenient JavaScript variable called csrf_token which you can include in your AJAX requests.

Syntex:

<script>
    var csrfToken = '{{ csrf_token() }}';
    // Use csrfToken in your AJAX requests
</script>

Then, you can include the CSRF token in your AJAX request headers like this:

Example :

$.ajax({
    url: '/your-route',
    type: 'POST',
    headers: {
        'X-CSRF-TOKEN': csrfToken
    },
    data: {
        // Your data
    },
    success: function(response) {
        // Handle success
    }
});
LARAVEL