TokenMismatch when back to form and resubmit.

Of course a mis-match happens. You shouldn't use back button. You need to redirect back to form with input if validation failed. This is covered in the docs.

https://laravel.com/docs/5.4/redirects#creating-redirects

i souldnt but visitor may use. i found this https://laracasts.com/discuss/channels/general-discussion/l5-disable-csrf-middleware-on-certain-routes

@yigitozmen why don't you remove the VerifyCsrfToken middleware all together because visitors may use the back button on any form really.

Jokes aside,.. why would any visitor use the back button if you redirect them back to the form as @jlrdw suggested?

@yigitozmen you really need the csrf if a form is being submitted. Take the time to learn correct security. There are videos on that, some free.

It's not about only validation fails. Suppose that a user will search some book in shop. so will fill the inputs according to wishes and post the form and then according to responsed data something will be listed. Maybe user will want to back to previous page and re-search something.

@jlrdw but if user goes back with back button?

Another option is to insert a header telling the browser submit a new get request when they use the back button. It's explained in this

http://security.stackexchange.com/questions/126969/is-it-possible-to-make-the-back-button-work-if-we-use-one-csrf-token-per-request

You can catch a csrf mismatch error and handle how ever you need. But it's definitely not a good idea to disable it.

by the way, why do i need csrf protection if i only search?

@yigitozmen have you studied the owasp security site? https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet

On paginating pages, like list you don't, it's for form submitting protection.

Thank you. i will read the page.

By the way, user will enter some data to the form (city, start date, end date etc..) and some books will be listed. I am doing this form with post request. When post request responsed something, i put them in session and redirect to get method and create a view. Am i wrong? If i use get request user will see query string and i don't want it too.

If its a search page, you don't need to use csrf.

Only forms that modify data need protection.