在 laravel 中为特定路由禁用 csrf

发布于07月31日

I've a payment system, where data is submitted to 3rd party site and than hauled back...

当数据返回时，它会点击特定的url，让我们说/ok route.$_REQUEST['transaction']

But because of laravel middleware I'm getting token mismatch. There is no way 3rd party payment API can generate token, so how I disable it? only for this route?

or is there a better option?

Route::get('/payment/ok',   'TransactionsController@Ok');
Route::get('/payment/fail', 'TransactionsController@Fail');

public function Ok( Request $request )
{
    $transId = $request->get('trans_id');

    if ( isset( $transId ) )
    {

        return $transId;

    }

}

推荐答案

由于5.1版Laravel的VerifyCsrfToken中间件允许指定从CSRF验证中排除的路由.为了实现这一点，您需要将路由添加到App\Http\Middleware\VerifyCsrfToken.php类的$except数组中:

<?php namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
  protected $except = [
    'payment/*',
  ];
}

See the docs for more information.