@csrf is used in Laravel to prevent CSRF attacks, which is protected by automatically generating a hidden field containing a security token in the form. When a user submits a form, the server verifies the token and rejects the request if it does not match, thus preventing the malicious site from forging a request. You should use @csrf in all forms that perform state changes, such as forms that log in, register, comment submission, and modify database data, and protection should be enabled even if some forms appear to be "safe". For situations where AJAX or front-end frameworks are used, the token can be sent by reading the XSRF-TOKEN cookie (such as Axios automatically handles it) or manually obtaining the token from the meta tag and adding X-CSRF-TOKEN in the request header. Also note: Do not disable CSRF protection without reason, APIs should also adopt mechanisms such as Sanctum or Passport; long-standing pages should be refreshed regularly; SPA applications recommend combining Laravel Sanctum to ensure security. In short, adding @csrf to the form or carrying a token in the request can effectively defend against most CSRF attacks, which is simple but easily ignored.

Laravel's @csrf Blade directive is one of the easiest and most effective ways to protect your forms from CSRF (Cross-Site Request Forgery) attacks. Here's how it works and how you should use it.

What does @csrf do in Laravel?

When you include @csrf inside a form in a Blade template, Laravel automatically generates a hidden input field containing a CSRF token. This token is a secure, randomly generated value that the server checks when the form is submitted. If the token doesn't match what Laravel expects, the request gets rejected — preventing malicious third-party sites from submitting requests on behalf of a logged-in user.

You'll typically see it used like this:

 <form method="POST" action="/submit">
    @csrf
    <!-- other form fields -->
</form>

Behind the scenes, Laravel turns that into something like:

 <input type="hidden" name="_token" value="randomly-generated-token-value">

This token is required for any POST, PUT, PATCH, or DELETE request handled by Laravel's routes that are protected by the VerifyCsrfToken middleware (which they are by default).

When and where to use @csrf

You should always use @csrf in forms that perform state-changing actions — especially when users are logged in. Here are some common scenarios:

• User login forms
• Registration forms
• Comment submission forms
• Any form that modifies data in the database

?? Important : Don't skip @csrf just because a form seems "safe". Even search forms or newsletter signups can be abused if not protected properly.

If you're using Vue, React, or another frontend framework that sends AJAX requests instead of traditional form submissions, you'll need to handle the CSRF token differently — more on that below.

How to handle CSRF tokens with JavaScript/AJAX

When you're not submitting forms the traditional way (like with Axios or Fetch API), you still need to send the CSRF token. Laravel makes this easy by setting a cookie called XSRF-TOKEN by default. Many HTTP clients (like Axios) will read this cookie automatically and set the X-XSRF-TOKEN header for you.

If you're manually managing headers, here's how you can get the token from the cookie and include it in your requests:

1. Get the token from the cookie:

    function getCookie(name) {
       let matches = document.cookie.match(new RegExp(
           "(?:^|; )" name.replace(/([\.$?*|{}\(\)\[\]\\\/\ ^])/g, '\\$1') "=([^;]*)"
       ));
       return matches ? decodeURIComponent(matches[1]) : undefined;
   }
   
   const token = getCookie('XSRF-TOKEN');

2. Send it with your request:

    fetch('/your-endpoint', {
       method: 'POST',
       headers: {
           'Content-Type': 'application/json',
           'X-CSRF-TOKEN': token
       },
       body: JSON.stringify({ /* your data */ })
   });

Alternatively, you can embed the token directly in your Blade view:

 <meta name="csrf-token" content="{{ csrf_token() }}">

Then grab it from there in your JS code.

Things to watch out for

• Never disable CSRF protection without a good reason – even APIs used by mobile apps should use some kind of token-based authentication (like Sanctum or Passport).
• CSRF tokens expire after a while , so if you have long-lived pages with forms, consider refreshing the token periodically.
• If you're building a SPA and using Laravel as an API backend, look into Laravel Sanctum for managing CSRF and session authentication securely.

Basically that's it. Just add @csrf to the form or bring tokens to the front-end request to block most CSRF attacks. Not complicated but easy to ignore.

The above is the detailed content of How do I use the @csrf Blade directive to protect against CSRF attacks?. For more information, please follow other related articles on the PHP Chinese website!