'How to disable CSRF Token in Laravel and why we have to disable it?

I want to see how I can disable CSRF token in Laravel and where I have to disable it. Is this good to disable it or not?

laravel


Solution 1:[1]

You can Disable CSRF on few routes by editing.

App\Http\Middleware\VerifyCsrfToken

and add your own routes name in protected 

$except = [] array.

It does not seems to be good practice as by doing this we are removing security feature of Laravel.

Solution 2:[2]

Many people explain how to do it, but they do not explain what the url should look like.

edit app/Http/Middleware/VerifyCsrfToken.php 

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * Indicates whether the XSRF-TOKEN cookie should be set on the response.
     *
     * @var bool
     */
    protected $addHttpCookie = true;

    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        '/user/my_function'
    ];
}

In the $except array(); we add a url with just a simple string. This points to a controller usually depending on how your route is setup.

For example I have a UserController.php file in my Controller folder. I have a route like. In the web.php routes file.

Route::post('/user', 'UserController@my_function')->name('my_function');

Also alternatively, if you came to this question simply because you don't know how to use the CSRF and you don't actually need to disable it, or make the URL except. You can use this method.

Add these lines to your app.blade.php if it is used for ajax related calls.

<script>
$(function() {
    $.ajaxSetup({
        headers: {
        'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content')
        }
    });
});
</script>

Solution 3:[3]

In laravel 9. Open file \App\Http\Middleware\VerifyCsrfToken.php

Disable for all routes

protected $except = [
    '*',
];

Disable for some routes

 protected $except = [
    'mobile/*',
    'news/articles',
];

I searched for a long time how to disable CSRF completely, there are many identical examples but they do not help

Solution 4:[4]

You can disable it in app/http/Kernel.php in the web middleware group.

Is this good to disable it or not?

No it's not. Read the Wikipedia page about CSRF to understand what CSRF is, the CSRF-Token prevents CSRF.

Solution 5:[5]

The CSRF token protects your application and it's users against cross-site request forgery. For more information on that, have a read here:

https://en.wikipedia.org/wiki/Cross-site_request_forgery

The token is validated via Middleware in Laravel. If you take a look at the file app/Http/Middleware/VerifyCsrfToken.php, you will see it gives you the option to add URLs that should be exempt from CSRF verification.

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        //
    ];
}

If you want to disable it entirely, you can find it in the Middleware group named web in app/Http/Kernel.php. Those are the middlewares that fire by default over HTTP requests.

I wouldn't recommend disabling it where possible though.

Solution 6:[6]

Hi just go to app/Http/Kernel.php file simply commented out line no 31

// \App\Http\Middleware\VerifyCsrfToken::class,

Solution 7:[7]

(Temporary fix. Not Recommended)

Just Open kernel.php (app/http) and disable

App\Http\Middleware\VerifyCsrfToken::class,

Solution 8:[8]

If you want to block csrf token verification easily head over to app/Middleware/VerifyCsrfToken.php to disable it for all routes protected $except = ['*']; or specify routes like this

 protected $except = ['/api/route/one', 'api/route/two'];

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Gaurav
Solution 2
Solution 3
Solution 4 António Almeida
Solution 5
Solution 6 umefarooq
Solution 7
Solution 8 Janvier

Related Questions