CSRF Protection: Excluding URIs From CSRF Protection
Excluding URIs From CSRF Protection
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
class VerifyCsrfToken extends Middleware
{
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
'stripe/*',
'http://example.com/foo/bar',
'http://example.com/foo/*',
];
} You may also exclude the routes by adding their URIs to the $except property of the VerifyCsrfToken middleware.
If you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.
Related concepts
→
Excluding URIs From CSRF Protection
Semantic portal