Laravel - CSRF Protection - Csrf Explanation
In case you're not familiar with cross-site request forgeries, let's discuss an example of how this vulnerability can be exploited. Imagine your application has a
/user/email route that accepts a
POST request to change the authenticated user's email address. Most likely, this route expects an
Without CSRF protection, a malicious website could create an HTML form that points to your application's
/user/email route and submits the malicious user's own email address:
If the malicious website automatically submits the form when the page is loaded, the malicious user only needs to lure an unsuspecting user of your application to visit their website and their email address will be changed in your application.
To prevent this vulnerability, we need to inspect every incoming
DELETE request for a secret session value that the malicious application is unable to access.