In Laravel 5, How to disable VerifycsrfToken middleware for specific route? - php

Question

I am using Laravel 5 for developing an app. My app is connected with VendHQ API and I am intended to get some data from VendHQ through their webhook. As per their Documentation
When an event happens and triggers a webhook, we’ll send a POST
request to a URL of your choosing. The POST request will be in the
UTF-8 charset, and application/x-www-form-urlencoded encoding.
The problem is, when they try to send a POST request to my Laravel app, no CSRF Token is added in their post request and VerifyCsrfToken middleware is looking for a token and finally it throws a TokenMismatchException.
My question is, how can I avoid this default VerifyCsrfToken Middleware for some specific routes while keeping other post requests active?

Answer 1

In Laravel 5 this has chagned a bit. Now you can simply add the routes you want to exclude from csrftoken verification, in $except array of the class
'VerifyCsrfToken' (\app\Http\Middleware\VerifyCsrfToken.php):
class VerifyCsrfToken extends BaseVerifier
{
protected $except = [
// Place your URIs here
];
}
Examples:
1. If you are using a route group:
Route::group(array('prefix' => 'api/v2'), function()
{
Route::post('users/valid','UsersController#valid');
});
Your $except array looks like:
protected $except = ['api/v2/users/valid'];
2. If you are using a simple route
Route::post('users/valid','UsersController#valid');
Your $except array looks like:
protected $except = ['users/valid'];
3. If you want to exclude all routes under main route (users in this case)
Your $except array looks like:
protected $except = ['users/*'];
see: http://laravel.com/docs/master/routing#csrf-excluding-uris

Answer 2

CSRF is enabled by default on all Routes in Laravel 5, you can disable it for specific routes by modifying app/Http/Middleware/VerifyCsrfToken.php
//app/Http/Middleware/VerifyCsrfToken.php
//add an array of Routes to skip CSRF check
private $openRoutes = ['free/route', 'free/too'];
//modify this function
public function handle($request, Closure $next)
{
//add this condition
foreach($this->openRoutes as $route) {
if ($request->is($route)) {
return $next($request);
}
}
return parent::handle($request, $next);
}
source

Answer 3

If you are using version 5.2 then in: app/Http/Middleware/VerifyCsrfToken.php
you can add the route to the attribute: protected $except.
For example:
protected $except = [
'users/get_some_info',
];
After you perform this change, make sure you add the route in your routes.php.

Answer 4

Add your route to App\Http\Middleware\VerifyCsrfToken.php file:
/**
* The URIs that should be excluded from CSRF verification.
*
* #var array
*/
protected $except = [
'route-name-1', 'route-name-2'
];