Last updated on October 18, 2026

Laravel for Beginners: CSRF Protection

Arlind Musliu

August 2, 2024 · 4 min read

This lesson is part of our free Laravel tutorial for beginners. The code examples use Laravel 13.

What is CSRF Protection in Laravel?

CSRF (Cross-Site Request Forgery) protection is a security measure implemented in web applications to prevent unauthorized actions from being performed on behalf of an authenticated user. In Laravel, CSRF protection is a built-in feature that helps safeguard your application against such attacks by ensuring that every form submission and sensitive request includes a unique token that verifies the request’s legitimacy.

Why is CSRF Protection Important?

CSRF attacks can be detrimental as they exploit the trust a web application has in the authenticated user. If not protected, malicious actors can trick users into performing unwanted actions such as changing account details, making unauthorized transactions, or even deleting important data. By implementing CSRF protection, Laravel ensures that only legitimate requests, initiated by the user, are processed by the application.

How Does Laravel Implement CSRF Protection?

In Laravel 13, CSRF protection is enabled by default for all routes that use the web middleware group. The PreventRequestForgery middleware does this work. In Laravel 12 and older, the same middleware was called VerifyCsrfToken. The web middleware group is applied to most of the routes in a typical Laravel application, ensuring strong protection.

Using CSRF Tokens

Laravel generates a unique CSRF token for each active user session. You add this token to a form with the @csrf Blade directive. Here’s an example of how to include a CSRF token in a form if you are using Blade for the frontend:

<form method="POST" action="/example">
    @csrf
    <!-- Form fields go here -->
    <button type="submit">Submit</button>
</form>

The @csrf directive generates a hidden input field with the CSRF token, ensuring that the token is submitted along with the form data.

Verifying CSRF Tokens

Laravel 13 checks every POST, PUT, PATCH or DELETE request in two steps. First, it reads the browser's Sec-Fetch-Site header. If the request comes from the same origin, Laravel accepts it without a token check. If this check does not pass, for example on an older browser or a site without HTTPS, Laravel compares the CSRF token with the token stored in the user's session. If the token is missing or invalid, Laravel rejects the request with a 419 response. This verification helps prevent unauthorized requests from being processed.

AJAX Requests

For AJAX requests, you need to include the CSRF token in the request headers. You can achieve this by setting the X-CSRF-TOKEN header with the token value. Here’s an example using Axios, but before that you could store the token in an HTML meta tag:
<meta name="csrf-token" content="{{ csrf_token() }}">

import axios from 'axios';

// Set the CSRF token as a common header
axios.defaults.headers.common['X-CSRF-TOKEN'] = document.querySelector('meta[name="csrf-token"]').getAttribute('content');

// Example of making an AJAX request with Axios
axios.post('/example-endpoint', {
    name: 'John Doe'
})
.then(response => {
    console.log(response.data);
})
.catch(error => {
    console.error('There was an error!', error);
});

This setup ensures that all Axios requests include the CSRF token, allowing Laravel to verify the request's legitimacy. If your frontend runs on the same domain, Axios can also do this for you: Laravel sends the token in an encrypted XSRF-TOKEN cookie, and Axios copies it into the X-XSRF-TOKEN header automatically.

Excluding Routes from CSRF Protection

In some cases, you might want to exclude certain routes from CSRF protection. This can be done by adding the route URIs to the preventRequestForgery method in your application’s bootstrap/app.php file:

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;

return Application::configure(basePath: dirname(__DIR__))
    ->withRouting(
        web: __DIR__.'/../routes/web.php',
        commands: __DIR__.'/../routes/console.php',
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
        $middleware->preventRequestForgery(except: [
            'stripe/*',
            'http://example.com/foo/bar',
            'http://example.com/foo/*',
        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //
    })->create();

Use this feature sparingly and only for routes where CSRF protection is genuinely unnecessary, as it reduces your application's security. In Laravel 11 and 12, this method is called validateCsrfTokens. Laravel 13 still accepts that name, but it is deprecated.

Conclusion

CSRF protection is a crucial aspect of web application security, and Laravel simplifies its implementation by providing built-in mechanisms to safeguard your application. By understanding and using Laravel’s CSRF protection features, you can protect your application from unauthorized actions and ensure a secure user experience.