Sorry, your session has expired. Please refresh and try again. - Laravel 5.8

Question

I create a route Route::post('/ddos/store','DdosController@store');

I also have a controller

public function store()
{

    dd("HERE");

    $ddos                = new Ddos;
    $ddos->ip            = $ip;
    $ddos->details       = $details;
    $ddoss->save();

    return $ddos;

}

I kept getting - when making a TEST post via postman

I suppose to see the text "HERE" from my controller.

What did I do wrong ?

Can I allow localhost? and my production VM IP to make the call ? — code-8, Sep 06 '19 at 00:09
I know that. They did that for security reasons. But my goals to open up one route for my VM to make a POST to. — code-8, Sep 06 '19 at 01:08
Is there a way to disabled CSRF token protection on a specific route ? — code-8, Sep 06 '19 at 01:09

Salim Djerbouh · Answer 1 · 2019-09-06T00:52:08.617

4

Postman is not sending a CSRF token in the request and your route is under the web routes group which applies the VerifyCsrfToken middleware

Either move your route to an api group or add it as an exception

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * Indicates whether the XSRF-TOKEN cookie should be set on the response.
     *
     * @var bool
     */
    protected $addHttpCookie = true;

    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'ddos/store'
    ];
}

edited Sep 06 '19 at 00:52

answered Sep 06 '19 at 00:30

Salim Djerbouh

10,719
6
29
61

What Laravel version is your suggestion? Mine is 5.8. It looks like this ![](https://i.imgur.com/DfAXbge.png) – code-8 Sep 06 '19 at 01:11
You can always override the properties of the BaseVerifier – Salim Djerbouh Sep 06 '19 at 01:18
@kyo A base Laravel 5.8 install's VerifyCsrfToken looks like this: https://raw.githubusercontent.com/laravel/laravel/5.8/app/Http/Middleware/VerifyCsrfToken.php Yours came from somewhere else - perhaps the app was an older version and not updated? – ceejayoz Sep 06 '19 at 14:39
On the contrary, it's the latest 6.x – Salim Djerbouh Sep 06 '19 at 16:47

score 3 · Accepted Answer · answered Sep 06 '19 at 00:30

There is a middleware executed before dd line executed. It's called CSRF Protection. You can exclude it by adding this line in the app\Http\Middleware\VerifyCsrfToken.

    protected $except = [
        '/ddos/store',
    ];

If you insist to keep sending csrf token with postman, you can create tests case and save it in environment variable (which i suggest). This link might help you.

Sorry, your session has expired. Please refresh and try again. - Laravel 5.8

2 Answers2