Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

tomirons's avatar

Disable CSRF on specific routes

I've got 5.2 and when I add a route into the $except array, it doesn't work at all.

I've tried

protected $except = [
        'donate/*'
];

and

protected $except = [
        'donate/paypal'
];

I've got a PayPal system that the IPN link is set to donate/paypal, when I use the sandbox and try to test it. It gives me the TokenMismatchException.

Also, the routes are all wrapped in the web middleware group, but with the except it shouldn't matter right?

0 likes
3 replies
lindstrom's avatar

Hmm, it shouldn't. The docs say: "You may exclude URIs by defining their routes outside of the web middleware group that is included in the default routes.php file, or by adding the URIs to the $except property of the VerifyCsrfToken middleware"

Try moving that route outside of the group as that will definitely exclude it from VerfyCsrfToken.

I'm on 5.2 (upgraded from 5.1) so I still have the 5.1 Kernel thus all my routes are subject to the global middleware that's been moved to 'web'. I have the except property set just as you do for my Mandrill webhook which goes through the Csrf middleware without issue.

tomirons's avatar

Yeah, it's not working for me. This is a bummer cause I need it for the PayPal IPN.

@lindstrom I tried moving it out of the route group and it still did the same thing. I'll try again though.

@TaylorOtwell Is there a reason it's not accepting the except array?

Please or to participate in this conversation.