Laravel5.2 Unwanted VerifyCsrfToken - php

Question

i set up fresh L5.2 and my route files after changes looks like that:
<?php
/*
|--------------------------------------------------------------------------
| Application Routes
|--------------------------------------------------------------------------
|
| Here is where you can register all of the routes for an application.
| It's a breeze. Simply tell Laravel the URIs it should respond to
| and give it the controller to call when that URI is requested.
|
*/
Route::get('/', function () {
return view('welcome');
});
Route::group(['middleware' =>'api', 'prefix' => '/api/v1'], function () {
Route::post('/api/v1/login', 'Api\V1\Auth\AuthController#postLogin');
});
When i go to postman and make POST: http://kumarajiva.dev/api/v1/login I get: TokenMismatchException in VerifyCsrfToken.php line 67
But me kernel file looks like that:
protected $middlewareGroups = [
'web' => [
\App\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
\App\Http\Middleware\VerifyCsrfToken::class,
],
'api' => [
'throttle:60,1',
],
];
I don't change anything. Route 'login' is in 'api' middelware group (not 'web' where is VerifyCsrfToken), but surprisingly I get above error. So I wonder - wtf? Howi it works? Do 'web' middelware group is allways executed (for each request)?

Answer 1

By default, it looks as if all routes are wrapped into the 'web' group.
Within RouteServiceProvider there is this function.
/**
* Define the "web" routes for the application.
*
* These routes all receive session state, CSRF protection, etc.
*
* #param \Illuminate\Routing\Router $router
* #return void
*/
protected function mapWebRoutes(Router $router)
{
$router->group([
'namespace' => $this->namespace, 'middleware' => 'web',
], function ($router) {
require app_path('Http/routes.php');
});
}
If you want a specific uri to not check for the CSRF Token, go to App\Http\Middleware\VerifyCsrfToken and add the uri to the $except array.
You can also use the CLI and php artisan route:list to see what routes are in behind what middleware.