如何防止 Laravel 路由被直接访问(即非 ajax 请求)

使用以下内容创建中间件文件app/Http/Middleware/OnlyAjax.php:

<?php 

namespace App\Http\Middleware;

class OnlyAjax
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, \Closure $next)
    {
        if ( ! $request->ajax())
            return response('Forbidden.', 403);

        return $next($request);
    }
}

然后在文件app/Http/Kernel.php中注册中间件

<?php namespace App\Http;

use Illuminate\Foundation\Http\Kernel as HttpKernel;

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * @var array
     */
    protected $middleware = [
        //... your original code
    ];

    /**
     * The application's route middleware.
     *
     * @var array
     */
    protected $routeMiddleware = [
        //... your original code
        'ajax' => \App\Http\Middleware\OnlyAjax::class,
    ];
}

最后，将中间件连接到任何只想通过AJAX访问的路由或路由组.即:

/// File: routes/web.php

// Single route
Route::any('foo', 'FooController@doSomething')->middleware('ajax');

// Route group
Route::middleware(['ajax'])->group(function () {
    // ...
});