


How to use middleware for Cross-site Request Forgery (CSRF) protection in Laravel
Nov 02, 2023 am 11:16 AMIn modern web applications, cross-site request forgery (CSRF) attacks have become a common attack method. Laravel is a popular PHP framework that has a built-in CSRF protection mechanism. , using middleware can easily add CSRF protection to applications.
This article will introduce how to use middleware for CSRF protection in Laravel and provide specific code examples.
What is a Cross-Site Request Forgery (CSRF) attack?
Cross-Site Request Forgery attack, the English name is Cross-Site Request Forgery, referred to as CSRF, is an attack method that initiates malicious requests by forging user identities.
Attackers usually carry out CSRF attacks by tricking users into clicking on pages with malicious links or inserting malicious scripts into websites where the victim has logged in. When the victim is logged in, the attacker initiates a series of malicious requests (such as changing passwords, posting messages, etc.). These requests appear to be legitimate to the victim, but in fact these requests are initiated by the attacker. This will cause certain harm to the victim.
How to use middleware for CSRF protection in Laravel?
Laravel provides us with a very convenient mechanism to protect applications from CSRF attacks. The Laravel framework has a built-in CSRF protection mechanism, which can be implemented through middleware.
In Laravel, we use CSRF middleware to check whether the CSRF token on POST, PUT, DELETE requests is valid. By default, Laravel adds the VerifyCsrfToken
middleware to your application and automatically checks whether the CSRF token for these requests is valid.
If the CSRF token is invalid, Laravel will throw a TokenMismatchException
exception and provide a default error view. We can also customize error handling according to our own needs.
Configure CSRF token
Laravel will generate a CSRF token for the application in each user session. We can configure the application in the configuration file config/csrf.php
Adjust the configuration of CSRF tokens. This configuration file allows you to configure the CSRF COOKIE and the name of the CSRF token in the request.
<?php return [ /* |-------------------------------------------------------------------------- | CSRF Cookie Name |-------------------------------------------------------------------------- | | The name of the cookie used to store the CSRF token. | */ 'cookie' => 'XSRF-TOKEN', /* |-------------------------------------------------------------------------- | CSRF Header Name |-------------------------------------------------------------------------- | | The name of the CSRF header used to store the CSRF token. | */ 'header' => 'X-XSRF-TOKEN', /* |-------------------------------------------------------------------------- | CSRF Token Expiration |-------------------------------------------------------------------------- | | The number of minutes that the CSRF token should be considered valid. | */ 'expire' => 60, ];
Using CSRF Middleware
VerifyCsrfToken
Middleware in Laravel will check whether the CSRF token is valid on any POST, PUT or DELETE request defined in the route . By default, the application's routes/web.php
file will also use the VerifyCsrfToken
middleware in addition to the web
middleware.
You can add CSRF middleware in the middleware group for use in other routes in the application. In order to protect a route with middleware, we can add it to the route definition using the middleware
method as follows:
Route::middleware(['web', 'csrf'])->group(function () { // });
Custom CSRF error handling
Default case If an incorrect CSRF token is detected using the VerifyCsrfToken
middleware, Laravel will throw a TokenMismatchException
exception and provide a default error view.
We can try to catch CSRF exceptions and specify our own error handling methods in the app/Exceptions/Handler.php
file. Here is an example of a custom CSRF exception handler:
<?php namespace AppExceptions; use Exception; use IlluminateFoundationExceptionsHandler as ExceptionHandler; use IlluminateSessionTokenMismatchException; class Handler extends ExceptionHandler { /** * A list of the exception types that should be reported. * * @var array */ protected $dontReport = [ TokenMismatchException::class, ]; /** * Report or log an exception. * * @param Exception $exception * @return void * * @throws Exception */ public function report(Exception $exception) { parent::report($exception); } /** * Render an exception into an HTTP response. * * @param IlluminateHttpRequest $request * @param Exception $exception * @return IlluminateHttpResponse * * @throws Exception */ public function render($request, Exception $exception) { if ($exception instanceof TokenMismatchException) { // 處理CSRF異常 return redirect() ->back() ->withInput($request->input()) ->with('error', 'CSRF Token Mismatch'); } return parent::render($request, $exception); } }
In the above code, we catch the TokenMismatchException
exception and use the with
method to pass the error message Save to error
flash data. Later, we can access this flash data in the view using the with
method.
Finally, we can add a CSRF token field to the view for any form that requires submitting a POST, PUT, or DELETE request. The CSRF token field can be generated in the form using the csrf_field
method as shown below:
<form method="POST" action="/example"> {{ csrf_field() }} <!-- Your form fields go here... --> <button type="submit">Submit</button> </form>
Summary
In this article, we have introduced how to use it in Laravel Middleware protects applications from CSRF attacks. We have effectively improved application security by configuring CSRF tokens, using the default VerifyCsrfToken
middleware, and customizing CSRF error handling methods. I believe these technologies can help you build more secure web applications.
The above is the detailed content of How to use middleware for Cross-site Request Forgery (CSRF) protection in Laravel. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Middleware is a filtering mechanism in Laravel that is used to intercept and process HTTP requests. Use steps: 1. Create middleware: Use the command "phpartisanmake:middlewareCheckRole". 2. Define processing logic: Write specific logic in the generated file. 3. Register middleware: Add middleware in Kernel.php. 4. Use middleware: Apply middleware in routing definition.

Laravel's page caching strategy can significantly improve website performance. 1) Use cache helper functions to implement page caching, such as the Cache::remember method. 2) Select the appropriate cache backend, such as Redis. 3) Pay attention to data consistency issues, and you can use fine-grained caches or event listeners to clear the cache. 4) Further optimization is combined with routing cache, view cache and cache tags. By rationally applying these strategies, website performance can be effectively improved.

Laravel'sMVCarchitecturecanfaceseveralissues:1)Fatcontrollerscanbeavoidedbydelegatinglogictoservices.2)Overloadedmodelsshouldfocusondataaccess.3)Viewsshouldremainsimple,avoidingPHPlogic.4)PerformanceissueslikeN 1queriescanbemitigatedwitheagerloading.

Using Seeder to fill test data in Laravel is a very practical trick in the development process. Below I will explain in detail how to achieve this, and share some problems and solutions I encountered in actual projects. In Laravel, Seeder is a tool used to populate databases. It can help us quickly generate test data, which facilitates development and testing. Using Seeder not only saves time, but also ensures data consistency, which is especially important for team collaboration and automated testing. I remember that in a project, we needed to generate a large amount of product and user data for an e-commerce platform, and Seeder came in handy at that time. Let's see how to use it. First, make sure your Lara is

Laravel's migration is a database version control tool that allows developers to programmatically define and manage database structure changes. 1. Create a migration file using the Artisan command. 2. The migration file contains up and down methods, which defines the creation/modification and rollback of database tables respectively. 3. Use the phpartisanmigrate command to execute the migration, and use phpartisanmigrate:rollback to rollback.

Laravel is suitable for beginners to create MVC projects. 1) Install Laravel: Use composercreate-project--prefer-distlaravel/laravelyour-project-name command. 2) Create models, controllers and views: Define Post models, write PostController processing logic, create index and create views to display and add posts. 3) Set up routing: Configure/posts-related routes in routes/web.php. With these steps, you can build a simple blog application and master the basics of Laravel and MVC.

InLaravel,policiesorganizeauthorizationlogicformodelactions.1.Policiesareclasseswithmethodslikeview,create,update,anddeletethatreturntrueorfalsebasedonuserpermissions.2.Toregisterapolicy,mapthemodeltoitspolicyinthe$policiesarrayofAuthServiceProvider.

In Laravel, routing is the entry point of the application that defines the response logic when a client requests a specific URI. The route maps the URL to the corresponding processing code, which usually contains HTTP methods, URIs, and actions (closures or controller methods). 1. Basic structure of route definition: bind requests using Route::verb('/uri',action); 2. Supports multiple HTTP verbs such as GET, POST, PUT, etc.; 3. Dynamic parameters can be defined through {param} and data can be passed; 4. Routes can be named to generate URLs or redirects; 5. Use grouping functions to uniformly add prefixes, middleware and other sharing settings; 6. Routing files are divided into web.php, ap according to their purpose
