Disable CSRF Token protection for Specific Routes or Globally in Laravel

CSRF token protection is security protocol which you help your site against attackers. But sometimes we need to disable for our requirement. This requirements can be globally or just for few routes. In Laravel we can achieve this task using several method let's learn one by one.

1. Disable CSRF Token Protection for Entire Application
2. Disable CSRF Token Protection for Specific Routes

Before Staring this, let's understanding what is CSRF Token Protection.

What is CSRF Token Protection?

CSRF token Protection is one type of security protocol. In Laravel, It automatically generates a CSRF "token" for each active user session managed by the application. This token is used to verify that the authenticated user is the person actually making the requests to the application.

Disable CSRF Token Protection for Entire Application

To disable CSRF protection for entire application we jus need to disable VerifyCsrfToken middleware into our application's Kernel file like below example :

app\Http\Kernel.php

    
protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        // \Illuminate\Session\Middleware\AuthenticateSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        //commented below line
        // \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],

    'api' => [
        // \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
        'throttle:api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
];
    

In above file we just commented one line that is loading middleware. Whenever we try to access web portal, request doesn't validate CSRF token.

Disable CSRF Token Protection for Specific Routes

In this examples, we will disable it for some specific routes or route groups. There are two ways to disable CSRF protection for particular routes.

• By VerifyCsrfToken Middleware
• By Route Methods

This both methods are provide by Laravel. You can use it according to you requirement.

By VerifyCsrfToken Middleware

Let's take some routes for our example.

    
Route::get('route1', ExampleController::class, 'route1');
Route::get('route2', ExampleController::class, 'route2');
Route::get('route3', ExampleController::class, 'route3');
Route::get('route4', ExampleController::class, 'route4');
Route::get('route5', ExampleController::class, 'route5');
    

VerifyCsrfToken itself provides way to disable CSRF protection by protected $except = []; array. Here we just have to pass specific routes. Checkout below example for it :

app\Http\Middleware\VerifyCsrfToken.php

    
<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    protected $except = [
        'route1', 'route2', 'route3', 'route4', 'route5',
    ];
}
    

By Route Methods

After Laravel 7.7 version it adds some new functions, one of then is withoutMiddleware. This function handles request without particular middleware. In other terms it takes array input and skips those inputs. Let's take another example for this method :

    
Route::get('route1', ExampleController::class, 'route1')->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
Route::get('route2', ExampleController::class, 'route2')->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
Route::get('route3', ExampleController::class, 'route3')->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
Route::get('route4', ExampleController::class, 'route4')->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
Route::get('route5', ExampleController::class, 'route5')->withoutMiddleware([\App\Http\Middleware\VerifyCsrfToken::class]);
    

As you can see, In this example we don't need to change VerifyCsrfToken middleware. We can directly achieve out task by route function.

Please note that withoutMiddleware method can only remove route middleware and does not apply to global middleware.