I am using Laravel 5.6. This is a typical form:
<form action="/about/contact" method="POST">
<input type="text" name="message"'/>
<input type="submit" class="savebutton" value="Send">
</form>
A valid post request will insert a row in a database. My assuption was that when I press the button multiple times within a second, then the browser would send multiple requests and thus the application would insert multiple rows in the database.
To my surprise, if I click the button multiple times, then I still could only find a single new row in the database.
Why is that? I have read in https://stackoverflow.com/a/50421832/2311074 that one has to regenerate the session token on each request in the tokensMatch() function from VerfiyCsrfToken. Since the answer is from 2014 I thought this might be build in now, but I checked the VerfiyCsrfToken class and could not find anything that regenerates the session. This is the current tokensMatch function:
/**
* Determine if the session and input CSRF tokens match.
*
* @param \Illuminate\Http\Request $request
* @return bool
*/
protected function tokensMatch($request)
{
$token = $this->getTokenFromRequest($request);
return is_string($request->session()->token()) &&
is_string($token) &&
hash_equals($request->session()->token(), $token);
}
So my question is: Is multiple submission prevented by default in Laravel? If so, where is that handeld? If it is not prevented, why can't I create multiple request when clicking the button often?
via Chebli Mohamed
Aucun commentaire:
Enregistrer un commentaire