Laravel 如何具体构建和判断 CSRF 令牌

Laravel just facilitates that for you by keeping the token stored in session, but the code is actually yours (to change as you wish). Take a look at filters.php you should see:

Route::filter('csrf', function()
{
    if (Session::token() != Input::get('_token'))
    {
        throw new Illuminate\Session\TokenMismatchException;
    }
});

它告诉我们，如果你有一条路由:

Route::post('myform', ['before' => 'csrf', 'uses' => 'MyController@update']);

And the user session expires, it will raise an exception, but you can do the work yourself, keep your own token stored wherever you think is better, and instead of throwing that exception, redirect your user to the login page:

Route::filter('csrf', function()
{
    if (MySession::token() != MyCSRFToken::get())
    {
        return Redirect::to('login');
    }
});

而且，是的，你可以创建自己的csrf_token()个，你只需要在Laravel之前加载它.如果你看看帮手们.在Laravel源代码中的php文件中，您将看到它仅在不存在的情况下创建该函数:

if ( ! function_exists('csrf_token'))
{
    function csrf_token()
    {
       ...
    }
}