Reputation: 10886

Laravel TokenMismatchException

Right now I'm learing laravel but I keep getting the exeption:

TokenMismatchException in VerifyCsrfToken.php line 53:

I'm trying to make an object of a migration and then write it to the database but for some reason it's not working. This is my route.php:

Route::get('/post/new',array(
'uses'=> 'blog@newPost',
'as' => 'newPost'
    ));
Route::post('/post/new', array (
'uses' => 'blog@createPost',
'as' => 'createPost'
    ));

This is my controller called blog.php:

use Illuminate\Http\Request;

use App\Http\Requests;
use View;
use App\Http\Controllers\Controller;
use App\posts;

    class blog extends Controller
    {
       public function newPost() 
       {
          return View::make('new');
       }

       public function createPost() 
       {
            $posts = new posts();
            $posts->title = Input::get('title');
            $posts->content = nl2br(Input::get('content'));
            $posts->save();
       }
    }

This is the migration:

<?php

use Illuminate\Database\Schema\Blueprint;
use Illuminate\Database\Migrations\Migration;

class CreatePostsTable extends Migration
{
    /**
     * Run the migrations.
     *
     * @return void
     */
    public function up()
    {
        Schema::create('posts',function($table) {
            $table->increments('id');
            $table->string('title');
            $table->text('content');
            $table->timestamps();
        });
    }

    /**
     * Reverse the migrations.
     *
     * @return void
     */
    public function down()
    {
        schema::drop('posts');
    }
}

And this is my main view:

@extends('master')
@section('content')
<h3>Add a blog post</h2>
 <form action="{{ URL::route('createPost') }}" method="post">
 <div class="form-group">
 <input name="title" class="form-control" type="text" placeholder="title"/>
 </div>
 <div class="form-group">
 <textarea name="content" class="form-control" placeholder="write here"> </textarea>
 </div>
 <input type="submit" class="btn btn-primary" />
 </form>
@stop

What could be wrong?

Upvotes: 6

Answers (5)

ArtisanBay

Reputation: 1041

I see that this question has been resolved but thought of sharing this info.

CSRF Protection

Laravel by default handled Cross Site Request Forgeries. Before posting any forms from our application we need to add a CSRF token to indicate the active user session. This token is verified to determine the authenticity of the user posting it.

Adding CSRF token

Within the form we could keep a hidden field whose value will be the csrf token likewise:

(blade template)

<input type="hidden" name="_token" value="{{ csrf_token() }}">

Within my application(Laravel 5.1) I have used illuminate/html facades. When I add a form as shown below, Form::open method would automatically add the above shown hidden field to that form.

{!! Form::open(array('action' => 'TestController@index','method' => 'POST'))!!}

You can notice within the Middleware/VerifyCsrfToken.php file, a function has been defined to check the token match.

CSRF In AJAX request

For AJAX request within your application you can pass the CSRF token along with the ajax post. Store the token in the meta tag.

<meta name="csrf-token" content="{{ csrf_token() }}" />

In Ajax Call

$.ajax({
    url: '/postAjaxUrl',
    type: 'POST',
    dataType: 'json',
    data: {user_id: 10},
    success: function(response) { 
        console.log(response);                              
    },
    beforeSend: function (request) {                    
        return request.setRequestHeader('X-CSRF-Token', $("meta[name='csrf-token']").attr('content'));
    }
 });

$.ajaxSetup({
    headers: {
        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
    }
});
// This will automatically include the CSRF token in all ajax request

Hope this is helpful. :)

Upvotes: 1

Rameez Rami

Reputation: 5728

i know the question is already answered but this is to add some extra information with the answer,

It is because you are not passing the security token along with your form data. please use

{{ Form::open(array('url' => 'foo/bar')) }}
   ........
........
{{ Form::close() }}

Laravel provides an easy method of protecting your application from cross-site request forgeries. First, a random token is placed in your user's session. If you use the Form::open method with POST, PUT or DELETE the CSRF token will be added to your forms as a hidden field automatically. Alternatively, if you wish to generate the HTML for the hidden CSRF field, you may use the token method:

echo Form::token();

you can find full documentation in this link http://laravel.com/docs/4.2/html

Upvotes: 0

Akshay Khale

Reputation: 8371

To prevent attacks on your laravel application laravel adds a CSR token to your form which is checked when form is submitted on server side as a security option so if you are getting this error means that your form doesn't contain CSR token so to include token in your form you can use {{ crsf_token() }} //blade option or <?php echo csrf_token();//Core PHP option ?>

In some cases you may want to disable the check of CSR token in your any of your page then you can achieve this by editing app/Http/Middleware/VerifyCsrfToken.php file and add the URL in except array but DO THIS IF IT'S THE ONLY OPTION not recommended cause it disables a security feature of laravel.

Upvotes: 2