Laravel - CSRF token禁用方法

关闭

Laravel默认是开启了CSRF功能,需要关闭此功能有两种方法:

方法一

打开文件:app\Http\Kernel.php

把这行注释掉:

 protected $middleware = [
\Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
\App\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
\App\Http\Middleware\VerifyCsrfToken::class,
    ];

‘App\Http\Middleware\VerifyCsrfToken’

方法二

打开文件:app\Http\Middleware\VerifyCsrfToken.php

修改为:

复制代码

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier {

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        // 使用CSRF
        //return parent::handle($request, $next);
        // 禁用CSRF
        return $next($request);
    }

}

使用

CSRF的使用有两种,一种是在HTML的代码中加入:

<input type="hidden" name="_token" value="{{ csrf_token() }}" />

另一种是使用cookie方式。

使用cookie方式,需要把app\Http\Middleware\VerifyCsrfToken.php修改为:

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier {

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        return parent::addCookieToResponse($request, $next($request));
    }

}

复制代码
使用cookie方式的CSRF,可以不用在每个页面都加入这个input的hidden标签。

部分使用

当然,也可以对指定的表单提交方式使用CSRF,如:

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier {

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        // Add this:
        if($request->method() == 'POST')
        {
            return $next($request);
        }

        if ($request->method() == 'GET' || $this->tokensMatch($request))
        {
            return $next($request);
        }
        throw new TokenMismatchException;
    }

}

只对GET的方式提交使用CSRF,对POST方式提交表单禁用CSRF

修改CSRF的cookie名称方法

通常使用CSRF时,会往浏览器写一个cookie,如:

要修改这个名称值,可以到打开这个文件:vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken.php

找到”XSRF-TOKEN“,修改它即可。

当然,你也可以在app\Http\Middleware\VerifyCsrfToken.php文件中,重写addCookieToResponse(…)方法做到。

<div class="post-text" itemprop="text"> <p>I seem to get this error occasionally on CSRF enabled forms. But once you go back and try submitting the form again, it works.</p> <pre><code>Illuminate\Session\TokenMismatchException: /var/www/laravel/app/filters.php:100 {closure} [internal]:0 call_user_func_array /var/www/laravel/vendor/laravel/framework/src/Illuminate/Events/Dispatcher.php:199 fire /var/www/laravel/vendor/laravel/framework/src/Illuminate/Events/Dispatcher.php:154 until /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php:1399 callRouteFilter /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php:1361 callAttachedBefores /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php:1248 callRouteBefore /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php:996 dispatchToRoute /var/www/laravel/vendor/laravel/framework/src/Illuminate/Routing/Router.php:968 dispatch /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Application.php:738 dispatch /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Application.php:708 handle /var/www/laravel/vendor/laravel/framework/src/Illuminate/Http/FrameGuard.php:38 handle /var/www/laravel/vendor/laravel/framework/src/Illuminate/Session/Middleware.php:72 handle /var/www/laravel/vendor/laravel/framework/src/Illuminate/Cookie/Queue.php:47 handle /var/www/laravel/vendor/laravel/framework/src/Illuminate/Cookie/Guard.php:51 handle /var/www/laravel/vendor/stack/builder/src/Stack/StackedHttpKernel.php:23 handle /var/www/laravel/vendor/laravel/framework/src/Illuminate/Foundation/Application.php:606 run /var/www/laravel/public/index.php:49 [main] </code></pre> <p>if there is any other information that might help, let me know. Thanks!</p> </div>
<div class="post-text" itemprop="text"> <p>Everything was working find but suddenly I got this error <code>TokenMismatchException in VerifyCsrfToken.php line 68:</code></p> <blockquote> <p>What I have tried</p> </blockquote> <p>I have checked my form and I used the <code>{!! csrf_field() !!}</code> also I used <code><meta name="csrf-token" content="{{ csrf_field() }}" /></code> and also both matches..</p> <p>Please check the login at this website and type any login information and you will see the error. <a href="http://egypt-pets.com/login" rel="nofollow noreferrer">http://egypt-pets.com/login</a></p> <blockquote> <p>Form Code</p> </blockquote> <pre><code> {{ Form::open(['route' => 'login', 'class' => 'form-signin', 'method' => 'post']) }} <h3 class="form-signin-heading">Welcome Back! Please Login</h3> <hr class="colorgraph"><br> {{ Form::label('email', 'Email: ') }} <input type="text" class="form-control" name="email" placeholder="example@example.com" required="" autofocus="" /> {{ Form::label('password', 'Password: ', ['class' => 'margin-top-20']) }} <input type="password" class="form-control" name="password" placeholder="******" required=""/> <div class="checkbox"> <label> <input style="width: 16px; margin-top: -11px;" type="checkbox" name="remember" {{ old('remember') ? 'checked' : '' }}> Remember Me </label> </div> <button class="btn btn-lg btn-success btn-block" name="Submit" value="Login" type="Submit"><i class="fa fa-user-o"></i> Login</button> <a class="btn btn-link" href="{{ route('password.request') }}"> Forgot Your Password? </a> <a class="btn btn-link pull-right" href="{{ route('register') }}"> Doesn't have an account? </a> <a href="login/facebook" class="btn btn-primary btn-block btn-lg margin-top-20" style="background-color: #3B5998"><i class="fa fa-facebook" style="margin-right: 10px"></i> Login In With Facebook</a> {{ Form::close() }} </code></pre> <p>I didn't use <code>{{ csrf_field() }}</code> because I used HTML helped which already put it.. And I have also tried to use the normal form and use <code>{{ csrf_field() }}</code> and got the same error</p> </div>
©️2020 CSDN 皮肤主题: 大白 设计师:CSDN官方博客 返回首页