针对Ajax请求的CSRF保护

Question

In laravel documentation , for ajax based applications, there is CSRF protection via HTML meta tag and cheking header request.

Why this method needed and why not check ajax request as usual request? I mean, if for ajax whe use POST method, then send CSRF token as usual parameter (for example as csrf_token ) and then check in server side (PHP) :

if ( !isset($_POST['csrf_token']) OR $_POST['csrf_token'] !== $_SESSION['csrf_token'] ) {
    // incorrect csrf token, stop processing
}

Cheking header request have some advantage than this method ?

Answer 1

If you are doing POST request, CSRF doesn't go through the header it goes through the http message body, what Laravel has is some kind of default middleware for csrf protection, where is the issue in that? If you go into assets/js folder you can see the CSRF token in bootstrap.js.

You can fetch a CSRF token from a global Javascript variable and send it through ajax post request body.