Update VerifyCsrfToken.php

[melisozmen]

Never sure :) but after I delete $this->encrypter->decrypt part from tokensMatch my global csrf middleware works fine..
is it ok??
(I am using 5.0.2)

[barryvdh]

No

See #6541 #7287 #7288

[melisozmen]

Finally I solved all my problems..

after all these updates there is no need to put _token in every ajax request or as hidden form element for token..

For post ajax requests there should be the code below in your global.js

$(function () {
    $.ajaxSetup({
                    headers: {
                        'X-XSRF-TOKEN': $('meta[name="_token"]').attr('content')
                    }
                });
});

put _token meta into your layouts

  <meta name="_token" content="{{ csrf_token() }}"/>

3. update App\Http\Middleware\VerifyCsrfToken.php middleware

   <?php namespace App\Http\Middleware;

use Closure;
use Symfony\Component\Security\Core\Util\StringUtils;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;

class VerifyCsrfToken extends BaseVerifier {

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request $request
     * @param  \Closure $next
     * @return mixed
     */
    public function handle($request, Closure $next){

        return parent::handle($request, $next);
    }

    function tokensMatch($request)
    {
        $token = $request->session()->token();

        $header = $request->header('x-xsrf-token');//in keys case sensitivity is important!!!!

        return StringUtils::equals($token, $request->input('_token')) ||
        ($header && StringUtils::equals($token, $header)) ;

    }


}

[RomainLanz]

Rails use the same method to handle the CSRFToken. Maybe better to change the default template to have a token already inside.