Beginner LevelLaravel
How does Laravel prevent Cross-Site Request Forgery (CSRF) attacks?
❓ Interview Prompt: Explain CSRF attacks, Laravel session CSRF tokens, @csrf Blade directive, and VerifyCsrfToken middleware.
Laravel automatically protects web routes against Cross-Site Request Forgery (CSRF) attacks.
Mechanism:
1
Laravel generates a unique CSRF token for every active user session.
2
HTML forms must submit this token in a '_token' field (via '@csrf' directive) or 'X-CSRF-TOKEN' HTTP header.
3
Middleware validates that the submitted token matches the session token, rejecting spoofed requests with a 419 status.
Code Implementation Example
html
<!-- Blade template HTML Form with CSRF Protection -->
<form action="/profile" method="POST">
@csrf
@method('PUT')
<input type="text" name="name" value="Alice">
<button type="submit">Update Profile</button>
</form>💡Blade form rendering @csrf and @method directives for secure POST submission.
🎯 Interview Key Takeaway
Always include @csrf in web forms to validate session security and defend against CSRF attacks.
#CSRF#Security#Tokens#Beginner
Back to all Laravel Questions→