2016-12-19 09:19
浏览 58

Angular2和Laravel CSRF保护

I have already read some topics

And the problem I encountered is lies in this piece of code

<meta property="csrf-token" name="csrf-token" content="{{ csrf_token() }}">

I'm using Angular2 as core engine, which sending AJAX requests to Laravel API and I'm not using blade templates - just .html files, so I can't call php function csrf_token() from html file

So, I added a temporary solution by extending my /var/www/pandacrm/app/Http/Middleware/VerifyCsrfToken.php file

public function handle($request, Closure $next)
    if ( ! $request->is('api/*'))
        return parent::handle($request, $next);

    return $next($request);

But it seems not the best way to work around, is there any other solutions to resolve this issue?

  • 写回答
  • 好问题 提建议
  • 关注问题
  • 收藏
  • 邀请回答

1条回答 默认 最新

  • dongqia0240 2016-12-20 04:52

    You can create a meta tag with csrf-token by using JavaScript in your html file!

    How to do this:

    Send an Ajax request to Laravel Route to get token. (return csrf-token in a Controller action) And then create a meta tag with that token in your html file.

    But before doing this, you have to disable csrf protection on that specific route. There is a way to do this here for laravel5 and here for 5.3.

    Now you have a meta tag with csrf that can be used for other ajax requests.

    解决 无用
    打赏 举报

相关推荐 更多相似问题