HTTP 浏览器访问Laravel时状态码419 api

Question

我无法通过浏览器（脚本/控制台/开发工具）在本地主机访问我的 laravel api 发布路由。 我总是收到 HTTP 419（页面已过期）状态错误。 有趣的是，我可以通过 postman 成功访问 api。

路由在每个“auth:sanctum”组之外，所以这不应该是失败的原因。 因此，我也认为会话和 session 配置不可能是原因，是吗？

// routes/api.php
Route::post('/test', function() {
    return "Hello World @ POST";
}); // => HTTP 419

Route::get('/test', function() {
    return "Hello World @ GET";
}); // => HTTP 200

我从 xsrf-checks 中排除了路径，以排除此错误原因：

// VerifyCsrfToken.php
protected $except = [
    'api/test',
];

我在 firefox 控制台运行的脚本：

await fetch("http://localhost:8000/api/test", {
    "method": "POST"
});

HTTP 请求 firefox 发送到本地主机：

POST /api/test HTTP/1.1
Host: localhost:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8000/
Origin: http://127.0.0.1:8000
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Content-Length: 0

我该怎么做才能让我的 api 在浏览器中运行？

编辑#1

应用程序/http/kernel.php

<?php

namespace App\Http;

use Illuminate\Foundation\Http\Kernel as HttpKernel;

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * These middleware are run during every request to your application.
     *
     * @var array<int, class-string|string>
     */
    protected $middleware = [
        // \App\Http\Middleware\TrustHosts::class,
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Http\Middleware\HandleCors::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
    ];

    /**
     * The application's route middleware groups.
     *
     * @var array<string, array<int, class-string|string>>
     */
    protected $middlewareGroups = [
        'web' => [
            \App\Http\Middleware\EncryptCookies::class,
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \Illuminate\Session\Middleware\StartSession::class,
            // \Illuminate\Session\Middleware\AuthenticateSession::class,
            \Illuminate\View\Middleware\ShareErrorsFromSession::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
        
        'api' => [
            \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
            'throttle:api',
            \Illuminate\Routing\Middleware\SubstituteBindings::class,
        ],
    ];

    /**
     * The application's route middleware.
     *
     * These middleware may be assigned to groups or used individually.
     *
     * @var array<string, class-string|string>
     */
    protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,
        'can' => \Illuminate\Auth\Middleware\Authorize::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
        'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
        'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
        'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
    ];
}

Answer 1

原因是App\Http\Middleware\VerifyCsrfToken which parent class is the Illuminate\Foundation\Http\Middleware\VerifyCsrfToken在它的 handle 方法中有这段代码：

public function handle($request, Closure $next)
    {
        if (
            $this->isReading($request) ||
            $this->runningUnitTests() ||
            $this->inExceptArray($request) ||
            $this->tokensMatch($request)
        ) {
            return tap($next($request), function ($response) use ($request) {
                if ($this->shouldAddXsrfTokenCookie()) {
                    $this->addCookieToResponse($request, $response);
                }
            });
        }

        throw new TokenMismatchException('CSRF token mismatch.');
    }

这个大if的第一个检查是$this->isReading($request) 。 该方法负责检查您正在使用的请求方法，如果您看到它的实现：

/**
     * Determine if the HTTP request uses a ‘read’ verb.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function isReading($request)
    {
        return in_array($request->method(), ['HEAD', 'GET', 'OPTIONS']);
    }

所以我想不需要更多的话了。

在这里您应该问自己为什么他们遗漏了POST方法。

如果您对此太确定，可以在App\Http\Middleware\VerifyCsrfToken覆盖该方法

<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array<int, string>
     */
    protected $except = [
        //
    ];

    protected function isReading($request): bool
    {
        return in_array($request->method(), ['HEAD', 'GET', 'OPTIONS', 'POST']);
    }
}

你可以开始阅读这个

Answer 2

1. 从浏览器访问 url post路由将不起作用。 除非你通过表格来做

<form action="/api/test" method="POST">
<button type="submit">Submit</button>
</form>

• 可以通过一个按钮/链接来连接它，该按钮/链接将提交隐藏在场景后面的表单

换句话说，从我所看到的你应该能够访问：

• GET /api/test（浏览器url，浏览器表单和postman）
• POST /api/test（浏览器表单，邮递员）