[Vuejs]-CSRF Token Duplication on Vue Router Laravel 5.3 Vue 2 JS

0👍

You seem to have a bit misunderstanding. You have the csrf token configured for axios, so every request will have a header field containing the token, then you just need to make sure every request goes through laravel’s csrf token validation function before it reaches your business logic, that’s all you need to do to prevent csrf. The get('/token') before post('/register') seems unnecessary.

Also, talking about the /token route itself, csrf_field is not appropriate here, since it generates a hidden form field (another way to send csrf token apart from what we talked about earlier) to be embedded in a .php file like <form>...<?=csrf_field()?>...</form> => <form>...<input type="hidden" name="laravel_csrf_token" value="***">...</form>, which makes it meaningless to request csrf_field‘s result via xhr.

Leave a comment