mcpField
L
laravel:request-forgery-protection

laravel:request-forgery-protection

github.com/jpcaparasSecurity15737 installsUpdated 17w ago
Repository

About laravel:request-forgery-protection

laravel:request-forgery-protection is a security skill for protecting Laravel state-changing routes from cross-site request forgery. It covers Laravel 13's origin-aware middleware alongside token checks, webhook exclusions, and testing guidance.

Key features

  1. 01Laravel 13 PreventRequestForgery guidance
  2. 02Token and origin-aware verification
  3. 03Scoped webhook exclusions and signature checks
  4. 04CSRF testing recommendations

Use cases

  1. 01Upgrading forgery middleware for Laravel 13
  2. 02Protecting state-changing routes
  3. 03Excluding third-party webhooks safely
  4. 04Testing missing or invalid CSRF tokens

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jpcaparas/superpowers-laravel --skill laravel:request-forgery-protection

After installing, type/laravel:request-forgery-protectionin Claude Code to confirm it loaded.

Details

From the project README

Request Forgery Protection

Protect state-changing routes from cross-site request forgery. Laravel 13 formalizes this as PreventRequestForgery, adding origin-aware verification (Sec-Fetch-Site) on top of token-based CSRF.

Commands

# Blade forms still emit tokens
<form method="POST" action="/profile">
    @csrf
    ...
</form>

# Laravel 13+: reference the new middleware class
use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;   // was: VerifyCsrfToken

->withoutMiddleware([PreventRequestForgery::class]);

# Optional origin-only mode (bootstrap/app.php)
->withMiddleware(function (Middleware $middleware) {
    $middleware->preventRequestForgery(originOnly: true);
})

# Exclude webhook URIs from verification
$middleware->validateCsrfTokens(except: ['stripe/*']);

Patterns

  • Keep @csrf in forms; origin verification is additive, token fallback covers older browsers/HTTP
  • Only enable originOnly when all clients are modern browsers over HTTPS
  • Exclude third-party webhook endpoints explicitly and verify their signatures instead
  • When upgrading to 13.x, replace VerifyCsrfToken references with PreventRequestForgery (old name remains a deprecated alias)
  • Never disable forgery protection globally to "fix" a failing integration — scope exclusions per URI

Testing

  • Feature tests bypass CSRF by default; add explicit tests for excluded webhook routes and their signature checks
  • Assert 419 responses for missing/invalid tokens where relevant

Comments

Markdown supported