Laravel 5 - Tokenmismatchexception in Verifycsrftoken.php line 67. How to solve this without using the FORM class?

Question

I have a php/Html project and I’m passing it to Laravel. Which means a lot of stuff I won’t create from scratch and I want to make the most of what’s already written.

At the moment I am working with a form. In the original code it is written using action="#" like this:

<form action="#" method="post" enctype="multipart/form-data" id="sky-form1" class="sky-form">

....

<button id="btn_login" type="submit" class="btn-u btn-block">Go Hme</button>
</form>

Then in Javascript I respond to the event click and direct to the desired page:

$(function(){
      $(document).on("click", "#btn_login", function(){
           //alert("ok");
           //return false;          
           $('form').attr('action','home.php');    

      }); //End of $(document).on("change", ...    
});//End of $(function(){

At the click of btn_login the user is directed to the home page.

Note: the code is not complete, only the most important parts. There is no login test or user test and so on. It is just a button inside a form on the index page that you should direct to the home page.

Now moving on to Laravel:

I have this route code that works. It directs me to the home page if I write to the URL myApp.com/home

Route::get('/home', function () {
    return view('home',['usertype'=>"2"]);
});

And the home page is accessed, as expected.

For the scenario of pressing the form button to be directed to home I made the following route code:

Route::post('/home', function () {
        return view('home',['usertype'=>"2"]);
    });

I used post and that was the only change.

In javascript I made a small change tbm:

$(function(){
          $(document).on("click", "#btn_login", function(){
               //alert("ok");
               //return false;          
               $('form').attr('action','home');    

          }); //End of $(document).on("change", ...    
 });//End of $(function(){

I changed the home php. for home (which is what is expected by the route).

So that’s the logic:

User presses login button, javascript pass the action of the form of action="#" for action="home" and the route of the port captures the request and returns the desired page. It is working.

The only problem is that when the home page tries to be accessed after clicking, I get the error: TokenMismatchException in VerifyCsrfToken.php line 67

I imagine it’s the verication of _token to prevent attacks CSRF.

Like I’m not using the class FORM The token is not generated within my form.

So my question is how to solve this problem without using the FORM class? Can I create the Hidden input and put the token value manually? Where do I find this value? And finally, there is a token for each form?

Answer 1

You can put this into the form (if you are using Blade templating):

<form method="POST" action="{{url('ROUTA DO POST')}}">
   {!! csrf_field() !!}
   ...
</form>

{!! csrf_field() !!} produces anything like: <input type="hidden" name="_token" value="8VI98KkDdCdHd0Wn62ha8OONrTAvViDFOW383ux2">, so will send the token via post to the server along with the other data.

It may also include input from csrf token 'manually', like this:

...
<input type="hidden" name="_token" value="<?php echo csrf_token(); ?>">
...

To answer your other question. You can disable checking this token for the routes you want (but I don’t think it’s that who wants to). So, yes, you need to send a token every time you make a post type request