PHP Laravel api sent json post with curl

Question

My problem is as follows

I have a counter api and it uses laravel. I need to send a post as json to this api, but when I send without headers, 419 page returns as expired, when I send headers, I get a csrf token missmatch error. However, I take the csrf token from the meta and put it in the headers.

I want to point out that I do not use Laravel, the api I will post is using Laravel.

My Code:

<?php 
$data = 'JSON DATA'; 
$wow = json_encode($data);

$ch = curl_init();
curl_setopt($ch, CURLOPT_COOKIEJAR, "cookie.txt");
curl_setopt($ch, CURLOPT_URL,"laravel api url");

$dom = new DOMDocument;
$dom->loadHTML($resultado);
$tags = $dom->getElementsByTagName('meta');
for ($i = 0; $i < $tags->length; $i++) {
    $grab = $tags->item($i);
    if ($grab->getAttribute('name') == 'csrf-token') {
        $token = $grab->getAttribute('content');
    }
}

ob_start();      // prevent any output
curl_exec ($ch); // execute the curl command
ob_end_clean();  // stop preventing output

curl_close ($ch);
unset($ch);

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_COOKIEFILE, "cookie.txt");
curl_setopt($ch, CURLOPT_URL,"LARAVEL API URL");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $wow);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Accept: application/json, text/plain, */*',
    'Accept-Encoding: gzip, deflate, br',
    'X-CSRF-TOKEN: '.$token.''));

$buf2 = curl_exec ($ch);

curl_close ($ch);

echo htmlentities($buf2);
?>

Why not just exclude that specific route from even needing a CSRF? — Ron
– Ron, Commented Aug 31, 2020 at 0:18
@Ron I guess that way because when I delete the csrf line through the headers, I get 419. — foreaxuse
– foreaxuse, Commented Aug 31, 2020 at 0:23
You can declare in Laravel, that a specific route is not even checked for CSRF.. once you do that, there cannot be a 419 error... as there's not token to expire.. — Ron
– Ron, Commented Aug 31, 2020 at 0:28

Ron · Accepted Answer · 2020-08-31 00:30:45Z

1

You can disable CSRF token completely for a specific route, if that makes sense for your app.

Check the DOCs and edit app/Http/Middleware/VerifyCsrfToken.php

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'stripe/*',
        'http://example.com/foo/bar',
        'http://example.com/foo/*',
    ];
}

answered Aug 31, 2020 at 0:30

Ron

6,8092 gold badges24 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP Laravel api sent json post with curl

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related