{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/8165","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/8165/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/8165/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/8165/events","html_url":"https://github.com/laravel/framework/issues/8165","id":64465479,"number":8165,"title":"Better way to selectively disable/enable CSRF protection on routes?","user":{"login":"phanan","id":8056274,"avatar_url":"https://avatars3.githubusercontent.com/u/8056274?v=4","gravatar_id":"","url":"https://api.github.com/users/phanan","html_url":"https://github.com/phanan","followers_url":"https://api.github.com/users/phanan/followers","following_url":"https://api.github.com/users/phanan/following{/other_user}","gists_url":"https://api.github.com/users/phanan/gists{/gist_id}","starred_url":"https://api.github.com/users/phanan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phanan/subscriptions","organizations_url":"https://api.github.com/users/phanan/orgs","repos_url":"https://api.github.com/users/phanan/repos","events_url":"https://api.github.com/users/phanan/events{/privacy}","received_events_url":"https://api.github.com/users/phanan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2015-03-26T08:10:12Z","updated_at":"2017-11-10T14:11:38Z","closed_at":"2015-03-26T10:24:38Z","author_association":"NONE","body":"(Firstly, I've searched the repo, but there's no exact discussion/answer to the question it seems. Please just close this off if I'm wrong).\n\nNow, Laravel 5 comes with CSRF protection enabled application-wide by default, which is good. If you want to disable it completely (RESTful?), just remove the middleware declaration from `app/Http/Kernel.php`, which is easy enough to do. The question is, how do you selectively disable it on several routes when still leaving it enabled at other places [1], and vice-versa [2]? \n\nFrom what I know, the current solution for [1] could be something like this:\n\n``` php\n// Single route\nRoute::post('/lorem/ipsum', 'LoremController@Ipsum', ['middleware' => 'csrf']);\n\n// Grouped routes\nRoute::group(['middleware' => 'csrf'], function()\n{\n    Route::post('/', function() {});\n    Route::post('user/profile', function() {});\n});\n```\n\nBut what about [2]? Apparently there's no such approach.  [This guy](http://www.techigniter.in/tutorials/disable-csrf-check-on-specific-routes-in-laravel-5/) came up with something like this:\n\n``` php\npublic function handle($request, Closure $next)\n{\n    // disable CSRF check on following routes\n    $skip = array(\n                'user/path/xys',\n                'user/profile',\n                'my/unprotected/route'\n                );\n\n    foreach ($skip as $key => $route) {\n        // skip csrf check on route\n        if($request->is($route)) {\n            return parent::addCookieToResponse($request, $next($request));\n        }\n    }\n\n    return parent::handle($request, $next);\n}\n\n```\n\nBasically he checks the URI of every request and compares it against a pre-defined list. This works, but the hard-coded paths make the whole thing look hacky and ugly, and HTTP verbs are not catered yet.\n\nSo, the question is, what is a better way to selectively disable CSRF on routes? Can/should Laravel introduce some elegant approach to allow disabling CSRF (and other middleware) on a per-route basis, just like we can enable them?\n\nAgain, sorry if this is something Laravel is already capable to do and I'm just babbling nonsense.\n"},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/343483329","html_url":"https://github.com/laravel/framework/issues/8165#issuecomment-343483329","issue_url":"https://api.github.com/repos/laravel/framework/issues/8165","id":343483329,"user":{"login":"alicompu","id":21305305,"avatar_url":"https://avatars1.githubusercontent.com/u/21305305?v=4","gravatar_id":"","url":"https://api.github.com/users/alicompu","html_url":"https://github.com/alicompu","followers_url":"https://api.github.com/users/alicompu/followers","following_url":"https://api.github.com/users/alicompu/following{/other_user}","gists_url":"https://api.github.com/users/alicompu/gists{/gist_id}","starred_url":"https://api.github.com/users/alicompu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alicompu/subscriptions","organizations_url":"https://api.github.com/users/alicompu/orgs","repos_url":"https://api.github.com/users/alicompu/repos","events_url":"https://api.github.com/users/alicompu/events{/privacy}","received_events_url":"https://api.github.com/users/alicompu/received_events","type":"User","site_admin":false},"created_at":"2017-11-10T14:11:38Z","updated_at":"2017-11-10T14:11:38Z","author_association":"NONE","body":"Hi for the group paths that you want to apply to everyone, use this method, which is my 5.5 larval version. Use the star =>\r\ngo to app/Http/Middleware/VerifyCsrfToken and add\r\n\r\n    protected $except = [\r\n        '/user/*'\r\n    ];\r\nThis is also my user's path\r\n\r\n    Route::group(['prefix' => 'user', 'namespace' => 'User', 'as' => 'user.'] , function (){\r\n\r\n"}}
{"actor":{"display_login":"alicompu"}}