CSRF

@csrf directive

Browsers attach cookies to every request, so a foreign form could post as your users. Laravel blocks such posts unless they carry a token that only your pages know.

Add the directive inside each POST form and the hidden token field appears.

<form method="POST"> @csrf <button type="submit">Save</button> </form>

Verify middleware

The web group checks unsafe requests through the VerifyCsrfToken middleware. GET requests pass freely, while POST, PUT, PATCH, and DELETE need a valid token.

A missing or stale token stops with status 419, so watch for that code when forms fail.

Route::post("/profile", [ProfileController::class, "update"]);

Send in headers

JavaScript requests cannot use the hidden field, so they send the token in a header instead. Read the token from the meta tag once, then attach it to every unsafe call.

The middleware accepts the header exactly like the form field.

fetch("/profile", { method: "POST", headers: {"X-CSRF-TOKEN": token}, });

Exclude webhooks note

Some routes receive posts from outside services that cannot know your token. Payment webhooks are the classic case: the payment service posts directly to your app.

List such URIs in the except array so the middleware skips them, and verify their signatures instead.

protected $except = [ "stripe/webhook", ];

Next: Hashing

Article author: Arthur Isaev