class PreventRequestForgery

Traits

Properties

protected array<int, string> $except

The URIs that should be excluded.

static protected array<int, string> $neverVerify

The globally ignored URIs that should be excluded from CSRF verification.

protected bool $addHttpCookie

Indicates whether the XSRF-TOKEN cookie should be set on the response.

static protected bool $allowSameSite

Indicates whether requests from the same site should be allowed.

static protected bool $originOnly

Indicates whether only origin verification should be used.

Methods

bool
inExceptArray(Request $request)

Determine if the request has a URI that should be excluded.

array
getExcludedPaths()

Get the URIs that should be excluded.

int
secondsUntil(DateInterval|DateTimeInterface|int $delay)

Get the number of seconds until the given DateTime.

int
availableAt(DateInterval|DateTimeInterface|int|null $delay = 0)

Get the "available at" UNIX timestamp.

parseDateInterval(DateInterval|DateTimeInterface|int|null $delay)

If the given value is an interval, convert it to a DateTime instance.

int
currentTime()

Get the current system time as a UNIX timestamp.

string
runTimeForHumans(float $startTime, float|null $endTime = null)

Given a start time, format the total run time for human readability.

__construct(Application $app, Encrypter $encrypter)

Create a new middleware instance.

Response
handle(Request $request, Closure $next)

Handle an incoming request.

bool
isReading(Request $request)

Determine if the HTTP request uses a 'read' verb.

bool
runningUnitTests()

Determine if the application is running unit tests.

bool
hasValidOrigin(Request $request)

Determine if the request has a valid origin based on the Sec-Fetch-Site header.

bool
tokensMatch(Request $request)

Determine if the session and input CSRF tokens match.

string|null
getTokenFromRequest(Request $request)

Get the CSRF token from the request.

bool
shouldAddXsrfTokenCookie()

Determine if the cookie should be added to the response.

Response
addCookieToResponse(Request $request, Response $response)

Add the CSRF token to the response cookies.

Cookie
newCookie(Request $request, array $config)

Create a new "XSRF-TOKEN" cookie that contains the CSRF token.

static void
except(array|string $uris)

Indicate that the given URIs should be excluded from CSRF verification.

static void
allowSameSite(bool $allow = true)

Indicate that requests from the same site should be allowed.

static void
useOriginOnly(bool $originOnly = true)

Indicate that only origin verification should be used.

static bool
serialized()

Determine if the cookie contents should be serialized.

static void
flushState()

Flush all static state.

Details

in ExcludesPaths at line 14
protected bool inExceptArray(Request $request)

Determine if the request has a URI that should be excluded.

Parameters

Request $request

Return Value

bool

at line 246
array getExcludedPaths()

Get the URIs that should be excluded.

Return Value

array

in InteractsWithTime at line 17
protected int secondsUntil(DateInterval|DateTimeInterface|int $delay)

Get the number of seconds until the given DateTime.

Parameters

DateInterval|DateTimeInterface|int $delay

Return Value

int

in InteractsWithTime at line 29
protected int availableAt(DateInterval|DateTimeInterface|int|null $delay = 0)

Get the "available at" UNIX timestamp.

Parameters

DateInterval|DateTimeInterface|int|null $delay

Return Value

int

in InteractsWithTime at line 41
protected DateTimeInterface|int parseDateInterval(DateInterval|DateTimeInterface|int|null $delay)

If the given value is an interval, convert it to a DateTime instance.

Parameters

DateInterval|DateTimeInterface|int|null $delay

Return Value

DateTimeInterface|int

in InteractsWithTime at line 57
protected int currentTime()

Get the current system time as a UNIX timestamp.

Return Value

int

in InteractsWithTime at line 65
protected string runTimeForHumans(float $startTime, float|null $endTime = null)

Given a start time, format the total run time for human readability.

Parameters

float $startTime
float|null $endTime

Return Value

string

at line 60
__construct(Application $app, Encrypter $encrypter)

Create a new middleware instance.

Parameters

Application $app
Encrypter $encrypter

at line 72
Response handle(Request $request, Closure $next)

Handle an incoming request.

Parameters

Request $request
Closure $next

Return Value

Response

Exceptions

TokenMismatchException
OriginMismatchException

at line 94
protected bool isReading(Request $request)

Determine if the HTTP request uses a 'read' verb.

Parameters

Request $request

Return Value

bool

at line 102
protected bool runningUnitTests()

Determine if the application is running unit tests.

Return Value

bool

at line 112
protected bool hasValidOrigin(Request $request)

Determine if the request has a valid origin based on the Sec-Fetch-Site header.

Parameters

Request $request

Return Value

bool

Exceptions

OriginMismatchException

at line 134
protected bool tokensMatch(Request $request)

Determine if the session and input CSRF tokens match.

Parameters

Request $request

Return Value

bool

at line 146
protected string|null getTokenFromRequest(Request $request)

Get the CSRF token from the request.

Parameters

Request $request

Return Value

string|null

at line 164
bool shouldAddXsrfTokenCookie()

Determine if the cookie should be added to the response.

Return Value

bool

at line 176
protected Response addCookieToResponse(Request $request, Response $response)

Add the CSRF token to the response cookies.

Parameters

Request $request
Response $response

Return Value

Response

at line 192
protected Cookie newCookie(Request $request, array $config)

Create a new "XSRF-TOKEN" cookie that contains the CSRF token.

Parameters

Request $request
array $config

Return Value

Cookie

at line 214
static void except(array|string $uris)

Indicate that the given URIs should be excluded from CSRF verification.

Boot-only. The list persists in a static property for the worker lifetime and applies to every subsequent request.

Parameters

array|string $uris

Return Value

void

at line 227
static void allowSameSite(bool $allow = true)

Indicate that requests from the same site should be allowed.

Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.

Parameters

bool $allow

Return Value

void

at line 238
static void useOriginOnly(bool $originOnly = true)

Indicate that only origin verification should be used.

Boot-only. The flag persists in a static property for the worker lifetime and applies to every subsequent request.

Parameters

bool $originOnly

Return Value

void

at line 254
static bool serialized()

Determine if the cookie contents should be serialized.

Return Value

bool

at line 262
static void flushState()

Flush all static state.

Return Value

void