Laravel 5 CSRF global token hidden field for all forms in a page

php laravel csrf
raphadko picture raphadko · Feb 13, 2015 · Viewed 94.6k times · Source

I recently migrated to Laravel 5, and now CSRF check is on every post submission. I thought about removing it but I want to follow the best practices, so I'll keep it that way.

On the other hand, I'm problems submitting ajax requests.. my page has multiple forms and some submissions are not even from forms, just plain ajax calls. My idea is to have one single hidden "token" input on the page and attach it to every submission. Are there any drawbacks on having that universal single token input?

Also, how can I output the token? Would it be ok to just create a hidden input on the page footer?

Answer

lukasgeiter picture lukasgeiter · Feb 13, 2015

I don't see any drawbacks. You can easily create a global token field in your layout file:

<input type="hidden" name="_token" id="csrf-token" value="{{ Session::token() }}" />

Or if you use the form builder:

{!! Form::token() !!}

In jQuery you could use something like this to attach the token to every request.

Related questions

Post request in Laravel - Error - 419 Sorry, your session/ 419 your page has expired

I installed Laravel 5.7 Added a form to the file \resources\views\welcome.blade.php <form method="POST" action="/foo" > @csrf <input type="text" name="name"/><br/> <input type="submit" value="Add"/> </…

Read More
"The page has expired due to inactivity" - Laravel 5.5

My register page is showing the form properly with CsrfToken ({{ csrf_field() }}) present in the form). Form HTML <form class="form-horizontal registration-form" novalidate method="POST" action="{{ route('register') }}"> {{ csrf_field() }} .... </form> I am using inbuilt authentication …

Read More
Laravel 5: Handle exceptions when request wants JSON

I'm doing file uploads via AJAX on Laravel 5. I've got pretty much everything working except one thing. When I try to upload a file that is too big (Bigger than upload_max_filesize and post_max_size I get a …

Read More