从外部发送到laravel应用程序时出现TokenMismatchException

Question

So I have an application that sends an AJAX request to an external server which does some stuff then makes a post call to the laravel application that made the initial call.

So I am trying to do a POST call to the laravel application. Now from the AJAX request i am sending the csrf_token()

Here are the headers I've put into my post request:

X-CSRF-TOKEN: LO8Dg7j1jZssXXGSLIa8inBgh2Y1QSsp6Birc1Ui
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded

That token belongs to the logged in user that made the AJAX request. Now the problem i'm getting is from this i get a TokenMismatchException500 error.

Is there something else I need to do in my external post calls headers in order to not encounter this error?

As i've got the CSRF token i am using a rest client to try send a test post using those headers and I get the same error?

The aim is on the recieving laravel app controller will then be able to use the token and i'll be able to use $request->user(); to get the user.

Note the recieving route has the web middleware attached to it.

Answer 1

Since you are making request from another server external url.Because of this you are getting erorr.Csrf token works with the same application not working if you try to exicute from other application. so you can disable csrf token.

if you want to disable token for all request then add this in VerifyCsrfToken

  protected $except = [
            '/*',
        ];

Excluding URIs From CSRF Protection

Sometimes you may wish to exclude a set of URIs from CSRF protection. For example, if you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.

Typically, you should place these kinds of routes outside of the web middleware group that the RouteServiceProvider applies to all routes in the routes/web.php file. However, you may also exclude the routes by adding their URIs to the $except property of the VerifyCsrfToken middleware:

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'stripe/*',
    ];
}

Ref: https://laravel.com/docs/5.5/csrf