CSRF Protection: Excluding URIs From CSRF Protection

Excluding URIs From CSRF Protection

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'stripe/*',
        'http://example.com/foo/bar',
        'http://example.com/foo/*',
    ];
}

You may also exclude the routes by adding their URIs to the $except property of the VerifyCsrfToken middleware.

If you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.

CSRF Protection: Excluding URIs From CSRF Protection — Structure map

Clickable & Draggable!

CSRF Protection: Excluding URIs From CSRF Protection — Related pages: