PreventRequestForgery
class PreventRequestForgery
Traits
Properties
| protected array<int, string> | $except | The URIs that should be excluded. |
|
| static protected array<int, string> | $neverVerify | The globally ignored URIs that should be excluded from CSRF verification. |
|
| protected bool | $addHttpCookie | Indicates whether the XSRF-TOKEN cookie should be set on the response. |
|
| static protected bool | $allowSameSite | Indicates whether requests from the same site should be allowed. |
|
| static protected bool | $originOnly | Indicates whether only origin verification should be used. |
Methods
Get the URIs that should be excluded.
Get the number of seconds until the given DateTime.
Get the "available at" UNIX timestamp.
If the given value is an interval, convert it to a DateTime instance.
Given a start time, format the total run time for human readability.
Determine if the application is running unit tests.
Determine if the request has a valid origin based on the Sec-Fetch-Site header.
Determine if the cookie should be added to the response.
Add the CSRF token to the response cookies.
Indicate that the given URIs should be excluded from CSRF verification.
Indicate that requests from the same site should be allowed.
Indicate that only origin verification should be used.
Determine if the cookie contents should be serialized.
Flush all static state.
Details
in
ExcludesPaths at line 15
protected bool
inExceptArray(Request $request)
Determine if the request has a URI that should be excluded.
at line 249
array
getExcludedPaths()
Get the URIs that should be excluded.
in
InteractsWithTime at line 17
protected int
secondsUntil(DateInterval|DateTimeInterface|int $delay)
Get the number of seconds until the given DateTime.
in
InteractsWithTime at line 29
protected int
availableAt(DateInterval|DateTimeInterface|int|null $delay = 0)
Get the "available at" UNIX timestamp.
in
InteractsWithTime at line 47
protected DateTimeInterface|int
parseDateInterval(DateInterval|DateTimeInterface|int|null $delay)
If the given value is an interval, convert it to a DateTime instance.
in
InteractsWithTime at line 63
protected int
currentTime()
Get the current system time as a UNIX timestamp.
in
InteractsWithTime at line 71
protected string
runTimeForHumans(float $startTime, float|null $endTime = null)
Given a start time, format the total run time for human readability.
at line 61
__construct(Application $app, Encrypter $encrypter)
Create a new middleware instance.
at line 95
protected bool
isReading(Request $request)
Determine if the HTTP request uses a 'read' verb.
at line 103
protected bool
runningUnitTests()
Determine if the application is running unit tests.
at line 113
protected bool
hasValidOrigin(Request $request)
Determine if the request has a valid origin based on the Sec-Fetch-Site header.
at line 135
protected bool
tokensMatch(Request $request)
Determine if the session and input CSRF tokens match.
at line 149
protected mixed
getTokenFromRequest(Request $request)
Get the CSRF token from the request.
Preserve raw input so tokensMatch can reject non-string tokens.
at line 167
bool
shouldAddXsrfTokenCookie()
Determine if the cookie should be added to the response.
at line 179
protected Response
addCookieToResponse(Request $request, Response $response)
Add the CSRF token to the response cookies.
at line 195
protected Cookie
newCookie(Request $request, array $config)
Create a new "XSRF-TOKEN" cookie that contains the CSRF token.
at line 217
static void
except(array|string $uris)
Indicate that the given URIs should be excluded from CSRF verification.
Boot-only. The list persists in a static property for the worker lifetime and applies to every subsequent request.
at line 230
static void
allowSameSite(bool $allow = true)
Indicate that requests from the same site should be allowed.
Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.
at line 241
static void
useOriginOnly(bool $originOnly = true)
Indicate that only origin verification should be used.
Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.
at line 257
static bool
serialized()
Determine if the cookie contents should be serialized.
at line 265
static void
flushState()
Flush all static state.