How to Disable CSRF Token for Specific Routes in Laravel ?

Gitesh Rautela

17 May 2023

In this article, we will learn how to disable CSRF token protection for specific routes in Laravel.

The Default Route Files –

All Laravel routes are defined in your route files, which are located in the routes directory. The routes/web.php file defines routes that are for your web interface. These routes are assigned the web middleware group, which provides features like session state and CSRF protection.

Excluding Specific Routes From CSRF Protection –

Sometimes, you may wish to exclude a route or set of routes from CSRF protection. For example, many times you face problems like laravel CSRF token mismatch, CSRF token mismatch laravel ajax and remove CSRF token in laravel form.

Laravel Disable CSRF Protection on Specific Routes –

Suppose you have following routes into your laravel apps and want to disable CSRF protection on all routes:

Route::post('route', 'ExampleController@index');
Route::post('/user/profile', 'UserProfileController@create');
Route::post('/orders/{id}', 'OrderController@update');

Route::post('route', 'ExampleController@index');

Route::post('/user/profile', 'UserProfileController@create');

Route::post('/orders/{id}', 'OrderController@update');

To disable CSRF token protection on specific routes, navigate to app\Http\Middleware and open VerifyCsrfToken.php file. Then update the following routes into VerifyCsrfToken.php file in your laravel apps as follow:

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array<int, string>
     */
    protected $except = [
        //
        'route', 
        'user/profile',
        'orders/{id}/*'
    ];
}

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware

{

/**

* The URIs that should be excluded from CSRF verification.

* @var array<int, string>

protected $except = [

'route',

'user/profile',

'orders/{id}/*'

];

}

Cheers! you have successfully disabled CSRF token protection on specific routes.

Conclusion

In this article, we have learnt how to disable csrf token protection for specific routes in laravel apps.

Thanks for reading this blog. Please comment below if you have any question. You can hire laravel developers to build your custom solutions on laravel and can also explore our extensions.