Hello @hussain_nayani ,
From your explanation, I'm assuming that you've created two web services for signing a user and registering a user. Laravel has a built-in mechanism for CSRF protection. In all POST requests, additional csrf_token is expected as a parameter, and this parameter is being checked on serverside. You can generate csrf token using
csrf_token();//helper
//or
//
<form method="POST" action="/profile">
@csrf
...
</form>
Please go through documentation.
You can disable this csrf protection by specifying your routes as you've done
<?php
namespace App\Http\Middleware;
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as BaseVerifier;
class VerifyCsrfToken extends BaseVerifier
{
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
"api/login",
"api/register"
];
}
However, this may not be good practice, since in the future you may need to work on API with either GET or POST or whatever methods.
Another simple solution is to use api.php file for your API routes. It's already there in routes directory from 5.3. If you go to Kernal.php, you'll see two middleware groups.web middleware group is applicable for your web routes, i.e. routes you've added in web.php file, and api group is applicable for routes added in api.php file. A class VerifyCsrfToken is being called only for web routes.
<?php
namespace App\Http;
use Illuminate\Foundation\Http\Kernel as HttpKernel;
class Kernel extends HttpKernel
{
...
protected $middlewareGroups = [
'web' => [
...
\App\Http\Middleware\VerifyCsrfToken::class,
\Illuminate\Routing\Middleware\SubstituteBindings::class,
],
'api' => [
...,
],
];
...
}
I would suggest you add these two routes in api.php.
Apology for the long explanation.
