dimanche 15 juillet 2018

Laravel: Is multiple submission prevented by default?

I am using Laravel 5.6. This is a typical form:

<form action="/about/contact" method="POST">
  

  <input type="text"  name="message"'/>  
  <input type="submit" class="savebutton" value="Send">
</form>

A valid post request will insert a row in a database. My assuption was that when I press the button multiple times within a second, then the browser would send multiple requests and thus the application would insert multiple rows in the database.

To my surprise, if I click the button multiple times, then I still could only find a single new row in the database.

Why is that? I have read in https://stackoverflow.com/a/50421832/2311074 that one has to regenerate the session token on each request in the tokensMatch() function from VerfiyCsrfToken. Since the answer is from 2014 I thought this might be build in now, but I checked the VerfiyCsrfToken class and could not find anything that regenerates the session. This is the current tokensMatch function:

  /**
     * Determine if the session and input CSRF tokens match.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function tokensMatch($request)
    {
        $token = $this->getTokenFromRequest($request);

        return is_string($request->session()->token()) &&
               is_string($token) &&
               hash_equals($request->session()->token(), $token);
    }

So my question is: Is multiple submission prevented by default in Laravel? If so, where is that handeld? If it is not prevented, why can't I create multiple request when clicking the button often?



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire