CODEWITHSUNDEEP
phplaravelvalidationheadercsrf
Darshan Prajapati
Darshan Prajapati

Reputation: 1014

XSRF-Token in Laravel

I implement login in laravel on login request there is two token generate one in body and another one is in header cookie.

When i remove value of body token it's show page expired error but when I remove value of xsrf-token it's not shows any error and login getting succesfull

POST /login HTTP/1.1
Host: <host>
Content-Length: 513
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: <Origin Address>
Content-Type: application/x-www-form-urlencoded
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: XSRF-TOKEN=<token>; laravel_session=<session token>
Connection: close

_token=<token>&userName=<userName>&password=<Password>

Anyone help me to explain this both token. and why page is not getting expired on remove value of xsrf-token value using burpusite tool.

Upvotes: 1

Views: 6566

Answers (1)

IBRAHIM EZZAT
IBRAHIM EZZAT

Reputation: 983

as mentioned in laravel document:

Laravel makes it easy to protect your application from cross-site request forgery (CSRF) attacks. Cross-site request forgeries are a type of malicious exploit whereby unauthorized commands are performed on behalf of an authenticated user.

also:

Laravel stores the current CSRF token in an encrypted XSRF-TOKEN cookie that is included with each response generated by the framework. You can use the cookie value to set the X-XSRF-TOKEN request header. This cookie is primarily sent as a convenience since some JavaScript frameworks and libraries, like Angular and Axios, automatically place its value in the X-XSRF-TOKEN header on same-origin requests.

Upvotes: 2

Related Questions