seb14717 seb14717 - 3 years ago 158
PHP Question

TokenMismatchException when post to a laravel application externally

So I have an application that sends an AJAX request to an external server which does some stuff then makes a post call to the laravel application that made the initial call.

So I am trying to do a POST call to the laravel application. Now from the AJAX request i am sending the


Here are the headers I've put into my post request:

X-CSRF-TOKEN: LO8Dg7j1jZssXXGSLIa8inBgh2Y1QSsp6Birc1Ui
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded

That token belongs to the logged in user that made the AJAX request. Now the problem i'm getting is from this i get a
500 error.

Is there something else I need to do in my external post calls headers in order to not encounter this error?

As i've got the CSRF token i am using a rest client to try send a test post using those headers and I get the same error?

The aim is on the recieving laravel app controller will then be able to use the token and i'll be able to use
to get the user.

Note the recieving route has the
middleware attached to it.

Answer Source

Since you are making request from another server external url.Because of this you are getting erorr.Csrf token works with the same application not working if you try to exicute from other application. so you can disable csrf token.

if you want to disable token for all request then add this in VerifyCsrfToken

  protected $except = [

Excluding URIs From CSRF Protection

Sometimes you may wish to exclude a set of URIs from CSRF protection. For example, if you are using Stripe to process payments and are utilizing their webhook system, you will need to exclude your Stripe webhook handler route from CSRF protection since Stripe will not know what CSRF token to send to your routes.

Typically, you should place these kinds of routes outside of the web middleware group that the RouteServiceProvider applies to all routes in the routes/web.php file. However, you may also exclude the routes by adding their URIs to the $except property of the VerifyCsrfToken middleware:


namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier
     * The URIs that should be excluded from CSRF verification.
     * @var array
    protected $except = [


Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download