How to use default csrf-token from AJAX request in Laravel

Question

I'm using Vuejs and I want to make an secure AJAX request (with axios) to my laravel server, but I think that CSRF protections doesn't work because I change the token of the frontend part and even then I can interact with the database.

I read that Laravel come with a file named [bootstrap.js] (https://laravel.com/docs/5.8/csrf#csrf-introduction) it is assumed that this file does this task by default, but it doesn't work for me. I think it's beacuse webpack doens't load the file when I run npm run watch but I don't know how to load it,

I searched for an answer but I only find Bootstrap tutorials :/

you are using laravel 5.8?

Thamer
– Thamer

2019-05-31 01:30:28 +00:00
Commented May 31, 2019 at 1:30 — Thamer
– Thamer, Commented May 31, 2019 at 1:30
No, im using Laravel Framework 5.6.39

user10276993
– user10276993

2019-05-31 01:34:48 +00:00
Commented May 31, 2019 at 1:34 — user10276993
– user10276993, Commented May 31, 2019 at 1:34

Natvarsinh Parmar - bapu · Accepted Answer · 2019-05-31 04:03:23Z

1

In head:

<meta name="csrf-token" content="{{ csrf_token() }}">

In ajax:

window.axios = require('axios');

window.axios.defaults.headers.common = {
    'X-CSRF-TOKEN' : document.querySelector('meta[name="csrf-token"]').getAttribute('content');
};

answered May 31, 2019 at 4:03

Natvarsinh Parmar - bapu

1,1381 gold badge8 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Theo Roque · Accepted Answer · 2019-05-31 02:13:50Z

0

You can put the CSRF in the meta as _token. Like this:

<meta name="csrf-token" content="{{ csrf_token() }}">

Visit the laravel documentation for this. https://laravel.com/docs/5.6/csrf#csrf-x-csrf-token

And then access it in your javascript.

answered May 31, 2019 at 2:13

Theo Roque

413 bronze badges

Comments

Thai Nguyen Hung · Accepted Answer · 2019-05-31 02:23:45Z

0

You should add VerifyCsrfToken middleware for the API group (app/Http/Kernel.php)

answered May 31, 2019 at 2:23

Thai Nguyen Hung

1,2327 silver badges14 bronze badges

2 Comments

user10276993 Over a year ago

Sounds logic let me see. But I need to include meta tag in my axios code ? Or it is automatic?

Thai Nguyen Hung Over a year ago

This declaration so your route will be wrapper middleware. So you need to include meta tag in the header of axios to passed

Collectives™ on Stack Overflow

How to use default csrf-token from AJAX request in Laravel

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related