Remove Csrf verifcation of specific route

Question

I'm trying to create an api with my laravel app, but when I do a post request to a route, Laravel by default tries to verify the csrf token. So, I want to remove this verification for the api routes. I want to maintain the verification for the front end request. But when I add the exception routes in app/Http/Middleware/VerifyCsrfToken.php, I'm getting this error:

block_exception clear_fix

this is the VerifyCsrfToken.php

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        //
        'log_bounces_complaints',
    ];
}

Answer 1

According to Laravel documentation:

"The VerifyCsrfToken middleware, which is included in the web middleware group, will automatically verify that the token in the request input matches the token stored in the session."

So if you remove "web middleware" from that specific route you should be good.

https://laravel.com/docs/5.2/routing#csrf-protection

In other words don't put your route under the web middleware group in routes.php

Route::group(['middleware' => 'web'], function () {
    // all your routes will go through CSRF check
}


// Anything outside will not go through the CRSF check unless you 
// define a middleware when constructing your controller.

Route::post('ajax', 'YourController@yourFunction');

As requested by my friend Charles, you can also put your route in $except array in VerifyCrsfToken middleware

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'your_custom_route/*',
    ];
}

Answer 2

Just extend the VerifyCsrfToken and add the urls you want to exclude.

<?php namespace App\Http\Middleware;

use Closure;
use Illuminate\Session\TokenMismatchException;

class VerifyCsrfToken extends \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken {

    protected $except_urls = [
        'your_specific_url/new_url',
        'your_specific_url/new_url_2',
        ...
    ];

    public function handle($request, Closure $next)
    {
        $regex = '#' . implode('|', $this->except_urls) . '#';

        if ($this->isReading($request) || $this->tokensMatch($request) || preg_match($regex, $request->path()))
        {
            return $this->addCookieToResponse($request, $next($request));
        }

        throw new TokenMismatchException;
    }

}

and in the Kernel, change the new middleware.

protected $middleware = [

    ...

    'App\Http\Middleware\VerifyCsrfToken',
];