{"id":766,"date":"2025-06-11T23:10:36","date_gmt":"2025-06-11T15:10:36","guid":{"rendered":"https:\/\/www.zhaozhao123.cn\/php\/php-application-manual\/laravel\/766.html"},"modified":"2025-06-11T23:10:36","modified_gmt":"2025-06-11T15:10:36","slug":"%e5%a6%82%e4%bd%95%e5%9c%a8laravel%e4%b8%ad%e7%a6%81%e7%94%a8%e6%88%96%e5%90%af%e7%94%a8csrf%e4%bf%9d%e6%8a%a4","status":"publish","type":"my1js","link":"https:\/\/www.zhaozhao123.cn\/php\/my1js\/766.html","title":{"rendered":"\u5982\u4f55\u5728Laravel\u4e2d\u7981\u7528\u6216\u542f\u7528CSRF\u4fdd\u62a4"},"content":{"rendered":"
\r\n
\r\n
\r\n
\r\n
\r\n
\"Bug编译狮\"<\/figure>\r\n\r\n\r\n\r\n

Bug编译狮<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
\r\n
\r\n

在Laravel中，CSRF（跨站请求伪造）保护是防止恶意用户通过伪造请求来访问受保护的资源的一种机制。默认情况下，Laravel会自动启用CSRF保护。然而，有时你可能需要禁用或启用这个保护。<\/p>\n

禁用CSRF保护<\/h3>\n

如果你希望在某些特定条件下禁用CSRF保护，可以在控制器中使用$csrfProtection<\/code>属性。以下是一个示例：<\/p>\n

namespace AppHttpControllers;\n\nuse IlluminateFoundationBusDispatchesRequests;\nuse IlluminateRoutingController as BaseController;\nuse IlluminateFoundationValidationValidatesRequests;\n\nclass ExampleController extends BaseController\n{\n    use DispatchesRequests, ValidatesRequests;\n\n    \/**\n     * Disable CSRF protection for this controller.\n     *\n     * @return void\n     *\/\n    public function __construct()\n    {\n        $this->middleware('web');\n        $this->middleware('disable-csrf-protection'); \/\/ 自定义中间件\n    }\n\n    \/**\n     * Example method to demonstrate CSRF protection being disabled.\n     *\n     * @return IlluminateHttpResponse\n     *\/\n    public function disableCsrfExample()\n    {\n        return view('example.disable_csrf');\n    }\n}<\/code><\/pre>\n
在这个示例中，我们创建了一个自定义的中间件disable-csrf-protection<\/code>，并在构造函数中将其应用到所有路由上。<\/p>\n
启用CSRF保护<\/h3>\n
如果你想在某些特定条件下启用CSRF保护，可以使用$csrfProtection<\/code>属性并设置为false<\/code>。以下是一个示例：<\/p>\n
namespace AppHttpControllers;\n\nuse IlluminateFoundationBusDispatchesRequests;\nuse IlluminateRoutingController as BaseController;\nuse IlluminateFoundationValidationValidatesRequests;\n\nclass ExampleController extends BaseController\n{\n    use DispatchesRequests, ValidatesRequests;\n\n    \/**\n     * Enable CSRF protection for this controller.\n     *\n     * @return void\n     *\/\n    public function __construct()\n    {\n        $this->middleware('web');\n        $this->middleware('enable-csrf-protection'); \/\/ 自定义中间件\n    }\n\n    \/**\n     * Example method to demonstrate CSRF protection being enabled.\n     *\n     * @return IlluminateHttpResponse\n     *\/\n    public function enableCsrfExample()\n    {\n        return view('example.enable_csrf');\n    }\n}<\/code><\/pre>\n
在这个示例中，我们创建了一个自定义的中间件enable-csrf-protection<\/code>，并在构造函数中将其应用到所有路由上。<\/p>\n
示例代码相关步骤<\/h3>\n
    \n
  1. \n
    创建自定义中间件<\/strong>：<\/p>\n
    php artisan make:middleware DisableCsrfProtection<\/code><\/pre>\n<\/li>\n
  2. \n
    编辑中间件文件<\/strong>：\n打开 app\/Http\/Middleware\/DisableCsrfProtection.php<\/code> 文件，并添加以下代码：<\/p>\n
    namespace AppHttpMiddleware;\n\nuse Closure;\n\nclass DisableCsrfProtection\n{\n   public function handle($request, Closure $next)\n   {\n       \/\/ 这里可以添加一些逻辑来决定是否禁用CSRF保护\n       \/\/ 例如，根据当前环境或用户身份进行判断\n       if (\/* 条件 *\/) {\n           $request->headers->remove('X-CSRF-TOKEN');\n       }\n\n       return $next($request);\n   }\n}<\/code><\/pre>\n<\/li>\n
  3. \n
    注册中间件<\/strong>：\n在 app\/Http\/Kernel.php<\/code> 文件中注册这个中间件：<\/p>\n
    protected $routeMiddleware = [\n   'auth' => AppHttpMiddlewareAuthenticate::class,\n   'can' => AppHttpMiddlewareCan::class,\n   'guest' => AppHttpMiddlewareRedirectIfAuthenticated::class,\n   'csrf' => AppHttpMiddlewareVerifyCsrfToken::class,\n   'disable-csrf-protection' => AppHttpMiddlewareDisableCsrfProtection::class,\n   'enable-csrf-protection' => AppHttpMiddlewareEnableCsrfProtection::class,\n];<\/code><\/pre>\n<\/li>\n
  4. \n
    应用中间件<\/strong>：\n在控制器中使用这个中间件：<\/p>\n
    namespace AppHttpControllers;\n\nuse IlluminateFoundationBusDispatchesRequests;\nuse IlluminateRoutingController as BaseController;\nuse IlluminateFoundationValidationValidatesRequests;\n\nclass ExampleController extends BaseController\n{\n   use DispatchesRequests, ValidatesRequests;\n\n   \/**\n    * Disable CSRF protection for this controller.\n    *\n    * @return void\n    *\/\n   public function __construct()\n   {\n       $this->middleware('web');\n       $this->middleware('disable-csrf-protection'); \/\/ 自定义中间件\n   }\n\n   \/**\n    * Example method to demonstrate CSRF protection being disabled.\n    *\n    * @return IlluminateHttpResponse\n    *\/\n   public function disableCsrfExample()\n   {\n       return view('example.disable_csrf');\n   }\n}<\/code><\/pre>\n<\/li>\n<\/ol>\n
    通过这些步骤，你可以灵活地控制Laravel应用程序中的CSRF保护。<\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>
    \r\n
    \r\n
    \r\n
    \r\n
    \r\n
    \"黑板Bug讲师\"<\/figure>\r\n\r\n\r\n\r\n
    黑板Bug讲师<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
    \r\n
    \r\n
    介绍<\/h2>
    跨站请求伪造（CSRF）是一种常见于web应用程序的安全漏洞。Laravel，一个流行的PHP框架，默认包含CSRF保护以确保应用程序的安全性。然而，在某些情况下，开发人员可能需要选择性地禁用或启用CSRF保护。在本教程中，我们将探索如何在Laravel应用程序中进行此类操作，包括从基本到高级的代码示例。<\/p>
    理解 Laravel 中的 CSRF 保护<\/h2>
    Laravel 包含自动检查每个 POST、PUT、PATCH 或 DELETE 请求中的 CSRF 令牌的中间件。这个令牌确保请求来自同一个应用，防止未经授权的操作。这个中间件全局应用于所有请求，但 Laravel 也提供了管理其行为的方法。<\/p>
    <!-- Example of a CSRF field in a Laravel form -->\n <form method=\"POST\" action=\"{{ route('example.route') }}\">\n     @csrf\n     <!-- Other form fields -->\n <\/form><\/code><\/pre>
    在Laravel中禁用CSRF保护。<\/h2>
    要禁用CSRF保护，您可以修改。VerifyCsrfToken<\/code>中间件。从基本的路由排除开始，编辑配置文件。$except<\/code>property.<\/p>
    namespace AppHttpMiddleware;\n\nuse IlluminateFoundationHttpMiddlewareVerifyCsrfToken as Middleware;\n\nclass VerifyCsrfToken extends Middleware\n{\n    protected $except = [\n        'route\/to\/exclude',\n        'another\/route\/to\/exclude',\n    ];\n}\n<\/code><\/pre>
    在这一配置下，指定的路由。$except<\/code>数组不会检查CSRF令牌。<\/p>
    为API路由禁用CSRF保护<\/h2>
    API通常使用令牌进行身份验证，不需要CSRF保护。你可以通过应用中间件来按组配置你的API路由，从而禁用CSRF检查。<\/p>
    \/\/ In your routes file (e.g., web.php or api.php)\nRoute::group(['middleware' => ['api']], function () {\n    \/\/ Your API routes\n});\n\n\/\/ In the RouteServiceProvider class\nprotected function mapApiRoutes()\n{\n    Route::prefix('api')\n        ->middleware('api')\n        ->namespace($this->namespace)\n        ->group(base_path('routes\/api.php'));\n}\n<\/code><\/pre>
    在特定的路由上启用CSRF保护。<\/h2>
    如果你已经全局禁用了CSRF保护，可能需要为某些路由重新启用它。这相对较少见，但可以通过应用以下代码来实现：web<\/code>中间件。<\/p>
    Route::post('protected\/route', function () {\n     \/\/ Route logic\n })->middleware('web');<\/code><\/pre>
    通过应用web<\/code>在该路由上添加中间件时，您已包含CSRF保护。<\/p>
    正在测试CSRF保护措施。<\/h2>
    在修改CSRF保护设置时，非常重要的是要彻底测试它们。以下是如何为一个受CSRF保护的路由编写功能测试的示例。<\/p>
    public function disable_test_route_without_middleware()\n {\n     $response = $this->withoutMiddleware()->post('\/route\/to\/test', []);\n     $response->assertStatus(200);\n }<\/code><\/pre>
    该测试确认，不应用CSRF中间件的情况下，路线是可访问的。<\/p>
    结论<\/h2>
    在本教程中，我们介绍了如何启用和禁用Laravel应用中的CSRF保护措施。正如您所学习的那样，管理CSRF保护对于确保您的应用程序的安全性和灵活性至关重要。请记住，在更改任何CSRF设置后要彻底测试以确保您的应用程序仍然安全。<\/p><\/body>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>
    \r\n
    \r\n
    \r\n
    \r\n
    \r\n
    \"长工码奴1523\"<\/figure>\r\n\r\n\r\n\r\n
    长工码奴1523<\/h2>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n\r\n\r\n\r\n
    \r\n
    \r\n
    在 Laravel 中，你可以通过以下两种方式来启用和禁用 CSRF 保护：<\/p>\n
      \n
    1. \n
      启用 CSRF 保护<\/strong><\/p>\n
      在 config\/app.php<\/code> 文件的 csrf_protection<\/code> 属性设置为 false<\/code>。<\/p>\n<\/li>\n<\/ol>\n
      return [\n    \/\/ ...\n    'csrf_protection' => false,\n];<\/code><\/pre>\n
      这将使应用程序完全不受 CSRF 的保护。<\/p>\n
        \n
      1. \n
        禁用 CSRF 保护<\/strong><\/p>\n
        如果你想暂时禁用 CSRF 保护，可以使用以下方法：<\/p>\n
          \n
        • 使用 protected_methods()<\/code> 方法：如果你正在处理 HTTP 请求，并且希望阻止 CSRF 被检测到，可以通过 protected_methods()<\/code> 方法添加自定义的方法名。<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
          public function protectedMethods()\n{\n    return ['authenticate'];\n}<\/code><\/pre>\n
            \n
          • 使用 csrf_field()<\/code> 和 csrf_token()<\/code> 方法：这些方法会生成一个用于验证请求是否为恶意攻击者的字段和令牌。当用户尝试提交表单时，这些字段会被自动填充，并且服务器会检查它们是否与令牌匹配。<\/li>\n<\/ul>\n
            \/\/ 检查请求是否是恶意攻击者\nif (! $this->request->isCsrf()) {\n    abort(403);\n}\n\n$token = csrf_token();\n\necho '<input type=\"hidden\" name=\"_token\" value=\"' . $token . '\">';\n\n\/\/ 如果提交的数据没有 token，则显示错误消息并返回 403 错误。\nif ($this->request->session()->has('_token')) {\n    echo '<div class=\"alert alert-danger\">Invalid CSRF Token!<\/div>';\n    return redirect('\/')->with('error', 'Invalid CSRF Token!');\n}<\/code><\/pre>\n
            以上就是在 Laravel 中禁用或启用 CSRF 保护的方法。根据你的需求选择合适的方式即可。<\/p>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\n","protected":false},"excerpt":{"rendered":"
            Bug编译狮 在Laravel中，CSRF（跨站请求伪造）保护是防&..<\/p>\n","protected":false},"author":1,"featured_media":0,"menu_order":0,"template":"","meta":{"_acf_changed":false},"tags":[],"my1js2nav":[44],"tuisongtax":[],"class_list":["post-766","my1js","type-my1js","status-publish","hentry","my1js2nav-laravel"],"acf":{"qian_art_seotitle":"","qian_art_seotitle_source":{"label":"SEO\u6807\u9898","type":"text","formatted_value":""},"qian_art_seokws":"","qian_art_seokws_source":{"label":"SEO\u5173\u952e\u8bcd","type":"text","formatted_value":""},"qian_art_stzhong":"","qian_art_stzhong_source":{"label":"\u4e2d | \u77ed\u6807\u9898","type":"text","formatted_value":""}},"_links":{"self":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js\/766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js"}],"about":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/types\/my1js"}],"author":[{"embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/media?parent=766"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/tags?post=766"},{"taxonomy":"my1js2nav","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/my1js2nav?post=766"},{"taxonomy":"tuisongtax","embeddable":true,"href":"https:\/\/www.zhaozhao123.cn\/php\/wp-json\/wp\/v2\/tuisongtax?post=766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}