Ways to prevent TokenMismatch Exception using AJAX

I have analyze that ratio of getting Token Mismatch Error is very high. And this error getting because of some of the silly mistakes. There are many reasons developers are doing mistakes. Here are some of the examples.

Not sending _token on header.
Not sending _token on data when using ajax.
Not Permission on Storage Path.
Invalid Session Storage path.

And there many other reasons, feel free to edit this question for more more ways to prevent this type of error.

标签： php laravel laravel-5.2 laravel-5.1 laravel-5.3

1条回答

一纸荒年 Trace。

2楼-- · 2019-08-01 03:38

Possible Change - 1

Setup Token on Header

Set the token on <head> of your default.blade.php view

<meta name="csrf-token" content="{{csrf_token()}}">

Add ajaxSetup on the top of your script, that will be accessible to everywhere. This will set headers on each ajax call

$.ajaxSetup({
    headers: {
        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
    }
});

Set Token on <form> tag

Add below function to your <form> tag. This function will generate a hidden field named _token and filled value with token

{{csrf_field()}}

Add csrf_token() function to your hidden _token in value attribute. This will generate only encrypted string.

<input type="hidden" name="_token" value="{{csrf_token()}}"/>.

Possible Change - 2

Check session storage path & Permission

Here assume that project app url is APP_URL=http://project.dev/ts/toys-store

Set the write permission to storage_path('framework/sessions')
Check the path of your laravel project 'path' => '/ts/toys-store', this path is root of your laravel project.

Change the name of your cookie 'cookie' => 'toys-store',

return [
    'driver' => env('SESSION_DRIVER', 'file'),
    'lifetime' => 120,
    'expire_on_close' => false,
    'encrypt' => false,
    'files' => storage_path('framework/sessions'),
    'connection' => null,
    'table' => 'sessions',
    'lottery' => [2, 100],
    'cookie' => 'toys-store',
    'path' => '/ts/toys-store',
    'domain' => null,
    'secure' => false,
    'http_only' => true,
];

Possible Change - 3

Use _token field on AJAX

There are many ways to send _token on AJAX call

Get all input field's value within <form> tag using var formData = new FormData($("#cart-add")[0]);
Use $("#cart-add").serialize(); or $("#cart-add").serializeArray();
Add _token manually on data of AJAX. using $('meta[name="csrf-token"]').attr('content') or $('input[name="_token"]').val().

We can set as header on a particular ajax call like below code.

$.ajax({
    url: "path/to/ajax",
    type: "POST",
    data: formData,
    processData: false,
    contentType: false,
    dataType: "json",
    headers: {
        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
    }
});

0人赞添加讨论(0) 举报

Ways to prevent TokenMismatch Exception using AJAX

采纳回答

编辑标签

举报内容

检举类型

检举原因

检举说明(必填)

打开微信“扫一扫”，打开网页后点击屏幕右上角分享按钮

付费偷看金额在0.1-10元之间