Disabling CSRF guard for specific routes

[alexweissman]

Sometimes, you need to exclude certain routes from CSRF checks. For example, routes that are meant to be consumed by another application instead of a browser (see #385, #521, #558, #568). It's also useful for things like raw asset loading, where you want to avoid initializing the CSRF middleware altogether, because it has a dependency on session - which in turn can cause too many read/write attempts in succession, as we saw with #633.

One option is to disable global CSRF middleware, and instead require that each route explicitly declare the CSRF check as route middleware ("whitelist" approach). I'm not sure if this would still end up initializing the middleware on routes that don't actually use it.

Or, we can leave global CSRF middleware enabled, and then provide a means for routes to declare themselves exempt from CSRF checks ("blacklist" approach). Again, we'd want to check the blacklist before the middleware is even instantiated in the first place.

You can see how we're implementing blacklisting for asset routes right now:

// Middleware
// Hacky fix to prevent sessions from being hit too much: ignore CSRF middleware for requests for raw assets ;-)
// See https://github.com/laravel/framework/issues/8172#issuecomment-99112012 for more information on why it's bad to hit Laravel sessions multiple times in rapid succession.
$request = $container->request;
$path = $request->getUri()->getPath();
$csrfBlacklist = [
    $container->config['assets.raw.path']
];
if (!$path || !starts_with($path, $csrfBlacklist)) {
    $app->add($container->csrf);
}

So, maybe we could just go with a blacklist, and build a wrapper around it so that it doesn't have to do this in index.php?

This is also related to #617.

[lcharette]

+1 For blacklist. Forget to whitelist one and you have a security issue

[alexweissman]

Ok, this has been implemented with the csrf.blacklist configuration setting, which maps regular expressions (matching routes) to arrays of HTTP methods. Any requests that match one of these blacklisted routes and methods will bypass the CSRF middleware.