CSRF跨多个应用程序/服务

Question

I have 2 applications under the same domain, 1 running from a PHP 5.6 server with Laravel 5.2 backend & Angular2 frontend, and the other with a custom framework on a PHP 5.3 server with flat javascript frontend. In each application I have a csrf token. The older server (5.3) has a custom csrf generator, but the laravel one uses laravel's VerifyCsrfToken.php middleware.

I occasionally need to call an old API from the angular2 frontend, but the csrf tokens do not match. How do I implement a custom csrf token generator in laravel?

Answer 1

You could create a OldTokenClassand pass the token to all your views. However, it's hard for me to speculate on what should be in OldTokenClass with the information you provide. Essentially, you should be able to generate or obtain the old app token from that class.

Something like

//Route
use App\Service\OldTokenClass;

view()->composer('*', function ($view) {
    $tokenGen =  new OldTokenClass();

    return $view->with('old_crsf_token', $tokenGen->get());

});

Then in your view layout you could do something like

    <meta name="old-csrf-token" content="{{$old_crsf_token}}">

and use it with angular.