Laravel - adding VerifyCsrfToken to controller getting ajax request - php

Question

I am creating a controller that receive an AJAX request and from Laravel documentation, i can send header with X-Csrf token
https://laravel.com/docs/5.5/csrf#csrf-x-csrf-token
On my Controller i have something like this :
public function checkPromotion(Request $request)
{
try {
$this->middleware('VerifyCsrfToken');
}
catch (TokenMismatchException $e){
return response()->json(['error' => 'Error Token Provided']);
}
}
}
When i tried and sent a blank post request to this controller , the respond was blank .

Answer 1

There are three issues here:
If you are going to add middleware in a controller, you must do so in the constructor.
Out of the box, you cannot handle middleware exceptions in a controller action. You'll need to handle the exception in your \App\Exceptions\Handler class. The handle method of that class will receive the TokenMismatchException when token verification fails.
The string 'VerifyCsrfToken' is not a valid way to reference your middleware.
Regarding #3, the middleware method takes the name of a middleware group, or the FQCN of a particular middleware.
The following should work:
$this->middleware(\App\Http\Middleware\VerifyCsrfToken::class)
(I'm assuming that you are using the default App namespace)
If you get a "Session store not set on request" exception, it's because cannot use CSRF middleware without the StartSession middleware.
Most likely what you really want is the web middleware:
$this->middleware('web')
This will include the CSRF middleware, the session start middleware, and a few others (see your http kernel for details).
If needed you can exclude routes from CSRF verification by using the $except array in your VerifyCsrfToken class

Answer 2

The middleware method on Controller is registering a middleware in an array on the controller. That middleware is not ran at that point.
When this method is called in a constructor the router/route collection will have access to the getMiddleware method after the Controller has been resolved to be able to build the middleware stack needed for the current route/action.
You may want to be dealing with this exception in your exception handler, App\Exceptions\Handler.
Laravel 5.5 Docs - Errors - The Exception Handler - Render Method
public function render($request, Exception $exception)
{
if ($exception instanceof \Illuminate\Session\TokenMismatchException) {
return response()->json(['error' => 'Error Token Provided']);
}
return parent::render($request, $exception);
}

Answer 3

protected function tokensMatch($request)
{
// If request is an ajax request, then check to see if token matches token provider in
// the header. This way, we can use CSRF protection in ajax requests also.
$token = $request->ajax() ? $request->header('X-CSRF-Token') : $request->input('_token');
return $request->session()->token() == $token;
}
Add this function inside VerifyCsrfToken.php