[PHP] - Laravel - CSRF token禁用方法
前文
CSRF攻击和漏洞的参考文章:
http://www.cnblogs.com/hyddd/archive/2009/04/09/1432744.html
Laravel默认是开启了CSRF功能,需要关闭此功能有两种方法:
方法一
打开文件:app\Http\Kernel.php
把这行注释掉:
'App\Http\Middleware\VerifyCsrfToken'
方法二
打开文件:app\Http\Middleware\VerifyCsrfToken.php
修改为:
<span style="color: #000000;">php namespace App\Http\Middleware; </span><span style="color: #0000ff;">use</span><span style="color: #000000;"> Closure; </span><span style="color: #0000ff;">use</span> Illuminate\Foundation\Http\Middleware\VerifyCsrfToken <span style="color: #0000ff;">as</span><span style="color: #000000;"> BaseVerifier; </span><span style="color: #0000ff;">class</span> VerifyCsrfToken <span style="color: #0000ff;">extends</span><span style="color: #000000;"> BaseVerifier { </span><span style="color: #008000;">/*</span><span style="color: #008000;">* * Handle an incoming request. * * @param \Illuminate\Http\Request $request * @param \Closure $next * @return mixed </span><span style="color: #008000;">*/</span> <span style="color: #0000ff;">public</span> <span style="color: #0000ff;">function</span> handle(<span style="color: #800080;">$request</span>, Closure <span style="color: #800080;">$next</span><span style="color: #000000;">) { </span><span style="color: #008000;">//</span><span style="color: #008000;"> 使用CSRF //return parent::handle($request, $next); // 禁用CSRF</span> <span style="color: #0000ff;">return</span> <span style="color: #800080;">$next</span>(<span style="color: #800080;">$request</span><span style="color: #000000;">); } }</span>
CSRF的使用有两种,一种是在HTML的代码中加入:
<span style="color: #0000ff;"><span style="color: #800000;">input </span><span style="color: #ff0000;">type</span><span style="color: #0000ff;">="hidden"</span><span style="color: #ff0000;"> name</span><span style="color: #0000ff;">="_token"</span><span style="color: #ff0000;"> value</span><span style="color: #0000ff;">="{{ csrf_token() }}"</span> <span style="color: #0000ff;">/></span></span>
另一种是使用cookie方式。
使用cookie方式,需要把app\Http\Middleware\VerifyCsrfToken.php修改为:
<span style="color: #000000;">php namespace App\Http\Middleware; </span><span style="color: #0000ff;">use</span><span style="color: #000000;"> Closure; </span><span style="color: #0000ff;">use</span> Illuminate\Foundation\Http\Middleware\VerifyCsrfToken <span style="color: #0000ff;">as</span><span style="color: #000000;"> BaseVerifier; </span><span style="color: #0000ff;">class</span> VerifyCsrfToken <span style="color: #0000ff;">extends</span><span style="color: #000000;"> BaseVerifier { </span><span style="color: #008000;">/*</span><span style="color: #008000;">* * Handle an incoming request. * * @param \Illuminate\Http\Request $request * @param \Closure $next * @return mixed </span><span style="color: #008000;">*/</span> <span style="color: #0000ff;">public</span> <span style="color: #0000ff;">function</span> handle(<span style="color: #800080;">$request</span>, Closure <span style="color: #800080;">$next</span><span style="color: #000000;">) { </span><span style="color: #0000ff;">return</span> parent::addCookieToResponse(<span style="color: #800080;">$request</span>, <span style="color: #800080;">$next</span>(<span style="color: #800080;">$request</span><span style="color: #000000;">)); } }</span>
使用cookie方式的CSRF,可以不用在每个页面都加入这个input的hidden标签。
当然,也可以对指定的表单提交方式使用CSRF,如:
<span style="color: #000000;">php namespace App\Http\Middleware; </span><span style="color: #0000ff;">use</span><span style="color: #000000;"> Closure; </span><span style="color: #0000ff;">use</span> Illuminate\Foundation\Http\Middleware\VerifyCsrfToken <span style="color: #0000ff;">as</span><span style="color: #000000;"> BaseVerifier; </span><span style="color: #0000ff;">class</span> VerifyCsrfToken <span style="color: #0000ff;">extends</span><span style="color: #000000;"> BaseVerifier { </span><span style="color: #008000;">/*</span><span style="color: #008000;">* * Handle an incoming request. * * @param \Illuminate\Http\Request $request * @param \Closure $next * @return mixed </span><span style="color: #008000;">*/</span> <span style="color: #0000ff;">public</span> <span style="color: #0000ff;">function</span> handle(<span style="color: #800080;">$request</span>, Closure <span style="color: #800080;">$next</span><span style="color: #000000;">) { </span><span style="color: #008000;">//</span><span style="color: #008000;"> Add this:</span> <span style="color: #0000ff;">if</span>(<span style="color: #800080;">$request</span>->method() == 'POST'<span style="color: #000000;">) { </span><span style="color: #0000ff;">return</span> <span style="color: #800080;">$next</span>(<span style="color: #800080;">$request</span><span style="color: #000000;">); } </span><span style="color: #0000ff;">if</span> (<span style="color: #800080;">$request</span>->method() == 'GET' || <span style="color: #800080;">$this</span>->tokensMatch(<span style="color: #800080;">$request</span><span style="color: #000000;">)) { </span><span style="color: #0000ff;">return</span> <span style="color: #800080;">$next</span>(<span style="color: #800080;">$request</span><span style="color: #000000;">); } </span><span style="color: #0000ff;">throw</span> <span style="color: #0000ff;">new</span><span style="color: #000000;"> TokenMismatchException; } }</span>
只对GET的方式提交使用CSRF,对POST方式提交表单禁用CSRF
修改CSRF的cookie名称方法
通常使用CSRF时,会往浏览器写一个cookie,如:
要修改这个名称值,可以到打开这个文件:vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken.php
找到”XSRF-TOKEN“,修改它即可。
当然,你也可以在app\Http\Middleware\VerifyCsrfToken.php文件中,重写addCookieToResponse(...)方法做到。
另外,如需要对指定的页面不使用CSRF,可以参考如下文章:
http://www.camroncade.com/disable-csrf-for-specific-routes-laravel-5/

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

MantisBT
Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

VSCode Windows 64-bit Download
A free and powerful IDE editor launched by Microsoft

SublimeText3 Linux new version
SublimeText3 Linux latest version

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

Dreamweaver CS6
Visual web development tools