How to use middleware for Cross-site Request Forgery (CSRF) protection in Laravel

In modern web applications, cross-site request forgery (CSRF) attacks have become a common attack method. Laravel is a popular PHP framework that has a built-in CSRF protection mechanism. , using middleware can easily add CSRF protection to applications.

This article will introduce how to use middleware for CSRF protection in Laravel and provide specific code examples.

What is a Cross-Site Request Forgery (CSRF) attack?

Cross-Site Request Forgery attack, the English name is Cross-Site Request Forgery, referred to as CSRF, is an attack method that initiates malicious requests by forging user identities.

Attackers usually carry out CSRF attacks by tricking users into clicking on pages with malicious links or inserting malicious scripts into websites where the victim has logged in. When the victim is logged in, the attacker initiates a series of malicious requests (such as changing passwords, posting messages, etc.). These requests appear to be legitimate to the victim, but in fact these requests are initiated by the attacker. This will cause certain harm to the victim.

How to use middleware for CSRF protection in Laravel?

Laravel provides us with a very convenient mechanism to protect applications from CSRF attacks. The Laravel framework has a built-in CSRF protection mechanism, which can be implemented through middleware.

In Laravel, we use CSRF middleware to check whether the CSRF token on POST, PUT, DELETE requests is valid. By default, Laravel adds the VerifyCsrfToken middleware to your application and automatically checks whether the CSRF token for these requests is valid.

If the CSRF token is invalid, Laravel will throw a TokenMismatchException exception and provide a default error view. We can also customize error handling according to our own needs.

Configure CSRF token

Laravel will generate a CSRF token for the application in each user session. We can configure the application in the configuration file config/csrf.php Adjust the configuration of CSRF tokens. This configuration file allows you to configure the CSRF COOKIE and the name of the CSRF token in the request.

<?php

return [

    /*
    |--------------------------------------------------------------------------
    | CSRF Cookie Name
    |--------------------------------------------------------------------------
    |
    | The name of the cookie used to store the CSRF token.
    |
    */

    'cookie' => 'XSRF-TOKEN',

    /*
    |--------------------------------------------------------------------------
    | CSRF Header Name
    |--------------------------------------------------------------------------
    |
    | The name of the CSRF header used to store the CSRF token.
    |
    */

    'header' => 'X-XSRF-TOKEN',

    /*
    |--------------------------------------------------------------------------
    | CSRF Token Expiration
    |--------------------------------------------------------------------------
    |
    | The number of minutes that the CSRF token should be considered valid.
    |
    */

    'expire' => 60,

];

Using CSRF Middleware

VerifyCsrfTokenMiddleware in Laravel will check whether the CSRF token is valid on any POST, PUT or DELETE request defined in the route . By default, the application's routes/web.php file will also use the VerifyCsrfToken middleware in addition to the web middleware.

You can add CSRF middleware in the middleware group for use in other routes in the application. In order to protect a route with middleware, we can add it to the route definition using the middleware method as follows:

Route::middleware(['web', 'csrf'])->group(function () {
    //
});

Custom CSRF error handling

Default case If an incorrect CSRF token is detected using the VerifyCsrfToken middleware, Laravel will throw a TokenMismatchException exception and provide a default error view.

We can try to catch CSRF exceptions and specify our own error handling methods in the app/Exceptions/Handler.php file. Here is an example of a custom CSRF exception handler:

<?php

namespace AppExceptions;

use Exception;
use IlluminateFoundationExceptionsHandler as ExceptionHandler;
use IlluminateSessionTokenMismatchException;

class Handler extends ExceptionHandler
{
    /**
     * A list of the exception types that should be reported.
     *
     * @var array
     */
    protected $dontReport = [
        TokenMismatchException::class,
    ];

    /**
     * Report or log an exception.
     *
     * @param  Exception  $exception
     * @return void
     *
     * @throws Exception
     */
    public function report(Exception $exception)
    {
        parent::report($exception);
    }

    /**
     * Render an exception into an HTTP response.
     *
     * @param  IlluminateHttpRequest  $request
     * @param  Exception  $exception
     * @return IlluminateHttpResponse
     *
     * @throws Exception
     */
    public function render($request, Exception $exception)
    {
        if ($exception instanceof TokenMismatchException) {
            // 处理CSRF异常
            return redirect()
                ->back()
                ->withInput($request->input())
                ->with('error', 'CSRF Token Mismatch');
        }

        return parent::render($request, $exception);
    }

}

In the above code, we catch the TokenMismatchException exception and use the with method to pass the error message Save to error flash data. Later, we can access this flash data in the view using the with method.

Finally, we can add a CSRF token field to the view for any form that requires submitting a POST, PUT, or DELETE request. The CSRF token field can be generated in the form using the csrf_field method as shown below:

<form method="POST" action="/example">
    {{ csrf_field() }}

    <!-- Your form fields go here... -->

    <button type="submit">Submit</button>
</form>

Summary

In this article, we have introduced how to use it in Laravel Middleware protects applications from CSRF attacks. We have effectively improved application security by configuring CSRF tokens, using the default VerifyCsrfToken middleware, and customizing CSRF error handling methods. I believe these technologies can help you build more secure web applications.

The above is the detailed content of How to use middleware for Cross-site Request Forgery (CSRF) protection in Laravel. For more information, please follow other related articles on the PHP Chinese website!