Understanding CSRF Tokens in Laravel

CSRF Tokens are a vital security feature in Laravel that help protect against Cross-Site Request Forgery (CSRF) attacks. These unique and unpredictable values are used to ensure that actions are initiated by legitimate users rather than malicious actors. In this article, we will explore the importance of CSRF tokens, how they work in Laravel applications, and how to configure them for security.

What is a CSRF Token?

A CSRF token, or Cross-Site Request Forgery token, is a security measure included in web applications to prevent unauthorized actions. The token is a randomly generated value associated with a user session and included in requests. When a user submits a form, the CSRF token is verified against the stored token in the session to ensure that the request is genuine.

How CSRF Tokens Work in Laravel

Laravel simplifies the process of implementing CSRF protection through its built-in CSRF middleware. Whenever a form is defined in the application, a hidden CSRF token field is automatically included. This token is then checked against the expected token stored in the user's session.

The @csrf Blade directive can be used to generate the token field in forms:

form method"POST"span>

    @csrf
    ...

/form

Excluding URIs from CSRF Protection

There may be instances where certain URIs need to be excluded from CSRF protection. For example, if you are implementing Stripe payments and utilizing their webhook system, you should exclude your webhook handler route from CSRF protection.

You can achieve this by adding the URI to the except property of the VerifyCsrfToken middleware:

php
namespace AppHttpMiddleware;

use IlluminateFoundationHttpMiddlewareVerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    //
    // The URIs that should be excluded from CSRF verification.
    //
    protected $except  [
        "stripe/",
    ];
}

Note that the CSRF middleware is automatically disabled during testing.

Additional Considerations

CSRF tokens can also be included in request headers and meta tags for AJAX-based applications. To facilitate this, Laravel includes the value of the meta csrf-token in the default Axios configuration:

// resources/js/bootstrap.js
['X-CSRF-TOKEN']  document.querySelector('meta[name"csrf-token"]').content;

The X-CSRF-TOKEN Request Header

The X-CSRF-TOKEN request header is another way to include CSRF tokens in requests. You can store the token in a meta tag and then instruct a library like jQuery to add the token to all request headers:

$.ajaxSetup({
    headers: {
        'X-CSRF-TOKEN': $('meta[name"csrf-token"]').attr('content')
    }
});

Additionally, Laravel provides a XSRF-TOKEN cookie for convenience, with its value automatically placed in the X-XSRF-TOKEN request header by some JavaScript frameworks and libraries.

Conclusion

CSRF tokens are an essential part of securing Laravel applications. By implementing and configuring CSRF protection, you can effectively mitigate the risk of CSRF attacks, ensuring the integrity and security of your web application. Remember to always validate and verify the tokens to protect user data and application functions.