PreventRequestForgery
class PreventRequestForgery
Traits
Properties
| protected array<int, string> | $except | The URIs that should be excluded. |
|
| static protected array<int, string> | $neverVerify | The globally ignored URIs that should be excluded from CSRF verification. |
|
| protected bool | $addHttpCookie | Indicates whether the XSRF-TOKEN cookie should be set on the response. |
|
| static protected bool | $allowSameSite | Indicates whether requests from the same site should be allowed. |
|
| static protected bool | $originOnly | Indicates whether only origin verification should be used. |
Methods
Get the URIs that should be excluded.
Get the number of seconds until the given DateTime.
Get the "available at" UNIX timestamp.
If the given value is an interval, convert it to a DateTime instance.
Given a start time, format the total run time for human readability.
Determine if the application is running unit tests.
Determine if the request has a valid origin based on the Sec-Fetch-Site header.
Determine if the cookie should be added to the response.
Add the CSRF token to the response cookies.
Indicate that the given URIs should be excluded from CSRF verification.
Indicate that requests from the same site should be allowed.
Indicate that only origin verification should be used.
Determine if the cookie contents should be serialized.
Flush all static state.
Details
in
ExcludesPaths at line 14
protected bool
inExceptArray(Request $request)
Determine if the request has a URI that should be excluded.
at line 246
array
getExcludedPaths()
Get the URIs that should be excluded.
in
InteractsWithTime at line 17
protected int
secondsUntil(DateInterval|DateTimeInterface|int $delay)
Get the number of seconds until the given DateTime.
in
InteractsWithTime at line 29
protected int
availableAt(DateInterval|DateTimeInterface|int|null $delay = 0)
Get the "available at" UNIX timestamp.
in
InteractsWithTime at line 41
protected DateTimeInterface|int
parseDateInterval(DateInterval|DateTimeInterface|int|null $delay)
If the given value is an interval, convert it to a DateTime instance.
in
InteractsWithTime at line 57
protected int
currentTime()
Get the current system time as a UNIX timestamp.
in
InteractsWithTime at line 65
protected string
runTimeForHumans(float $startTime, float|null $endTime = null)
Given a start time, format the total run time for human readability.
at line 60
__construct(Application $app, Encrypter $encrypter)
Create a new middleware instance.
at line 94
protected bool
isReading(Request $request)
Determine if the HTTP request uses a 'read' verb.
at line 102
protected bool
runningUnitTests()
Determine if the application is running unit tests.
at line 112
protected bool
hasValidOrigin(Request $request)
Determine if the request has a valid origin based on the Sec-Fetch-Site header.
at line 134
protected bool
tokensMatch(Request $request)
Determine if the session and input CSRF tokens match.
at line 146
protected string|null
getTokenFromRequest(Request $request)
Get the CSRF token from the request.
at line 164
bool
shouldAddXsrfTokenCookie()
Determine if the cookie should be added to the response.
at line 176
protected Response
addCookieToResponse(Request $request, Response $response)
Add the CSRF token to the response cookies.
at line 192
protected Cookie
newCookie(Request $request, array $config)
Create a new "XSRF-TOKEN" cookie that contains the CSRF token.
at line 214
static void
except(array|string $uris)
Indicate that the given URIs should be excluded from CSRF verification.
Boot-only. The list persists in a static property for the worker lifetime and applies to every subsequent request.
at line 227
static void
allowSameSite(bool $allow = true)
Indicate that requests from the same site should be allowed.
Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.
at line 238
static void
useOriginOnly(bool $originOnly = true)
Indicate that only origin verification should be used.
Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.
at line 254
static bool
serialized()
Determine if the cookie contents should be serialized.
at line 262
static void
flushState()
Flush all static state.