jeudi 19 juillet 2018

Laravel 5.6 CSRF token not validating / checked

I have:

Blade

<form class="form-horizontal was-validated" method="POST" action="">
  
  
  <div class="form-group row">
    <label class="col-sm-2 col-form-label">&nbsp;</label>
    <div class="col-sm-10">
      <input id="application_type" type="hidden" name="application_type" value="">
      <button type="submit" class="btn btn-primary">Submit</button>
    </div>
  </div>
</form>

received by controller:

public function store(Request $request)
{

    $requestData = $request->all();

    $requestData['application_id'] = strtolower(trim($requestData['application_id'].'.'.config('app.fqdn_base')));

    $request->replace($requestData);

    $values =  $this->validate($request, [
        'application_type' => 'required|exists:applications,name',
        /* other validations */
    ]);

    $exitCode = Artisan::call('tenant:create', [
        /* passing param here */
    ]);

    $host = Hostname::where('fqdn', $values["application_id"])->first();
    $web = $host->website;

    $web->name = $values["application_name"];
    $web->application_id = Application::where('name', '=', $values["application_type"])->pluck('id')->first();
    $web->owner = auth()->id();
    $web->save();

    $applications = Application::where('id', '!=', '0')->get();
    return view('admin.applications', [ "applications" =>  $applications]);
}

above code is working fine, except... CSRF function, I have check that I could retrieve CSRF value from request.

however, once my transaction done and redirect to the page that I want, If I press F5 it will re-submit the form, and this should result CSRF missmatch, but in my case, It didn't.

is there a specific way to turn on CSRF validation?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire