Why does the Laravel API return a 419 status code on POST and PUT methods?

by

If you are developing REST APIs, you better not add tokens. If you are using 5.4 or 5.5 you can use api.php instead of web.php. In api.php you don’t need token verifcation on post requests.

If you are using web.php, then you can exculde routes that you don’t want to validate with CSRF Tokens.

Here is the official documentation:

Excluding URIs From CSRF Protection

Sometimes you may wish to exclude a set of URIs from CSRF protection. For example, if you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.

Typically, you should place these kinds of routes outside of the web middleware group that the RouteServiceProvider applies to all routes in the routes/web.php file. However, you may also exclude the routes by adding their URIs to the $except property of the VerifyCsrfToken middleware:

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'stripe/*',
        'http://example.com/foo/bar',
        'http://example.com/foo/*',
    ];
}

For reference https://laravel.com/docs/5.5/csrf

More Related Contents:

  1. Laravel 5.1, Return response to user, then excute some code [closed]
  2. How to set up file permissions for Laravel?
  3. Call a REST API in PHP
  4. How to pass data to all views in Laravel 5?
  5. How to query between two dates using Laravel and Eloquent?
  6. Laravel Check If Related Model Exists
  7. SQLSTATE[HY000] [2002] Connection refused within Laravel homestead
  8. How to Get the Query Executed in Laravel 5? DB::getQueryLog() Returning Empty Array
  9. Laravel-5 ‘LIKE’ equivalent (Eloquent)
  10. AngularJS Upload Multiple Files with FormData API
  11. Laravel Model with Two Primary Keys update [duplicate]
  12. Laravel: How can I change the default Auth Password field name?
  13. Access denied for user ‘homestead’@’localhost’ (using password: YES)
  14. Trying to get Laravel 5 email to work
  15. Laravel 5.3 multiple file uploads
  16. Access to Laravel 5 app locally from an external device
  17. Script @php artisan package:discover handling the post-autoload-dump event returned with error code 255
  18. Custom pagination view in Laravel 5
  19. How to get client IP address in Laravel 5+
  20. Prevent Browser’s Back Button Login After Logout in Laravel 5
  21. How to call a controller function inside a view in laravel 5
  22. Laravel – How to get current user in AppServiceProvider
  23. Get “Content-Type” header of request in PHP
  24. How can I do a migration in laravel 5.5?
  25. laravel 5.3 new Auth::routes()
  26. Laravel changing timezone not reflecting the correct time
  27. Error 405 (Method Not Allowed) Laravel 5
  28. Unit Test Laravel’s FormRequest
  29. How do I restrict JSON access?
  30. find in set in laravel ? example

Leave a Comment