Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

cherire's avatar

Livewire 3 : How to disable CSRF token for a component?

Hi there;

How to disable CSRF in livewire 3 ?

In version 2, I used the following code in my VerifyCsrfToken middleware:

class VerifyCsrfToken extends Middleware { protected $except = [ 'livewire/message/{component-name-separated-with-dashes}', ]; }

Now that I'm transitioning to Livewire 3, i don't want to exclude 'livewire/update'

How can I accomplish for single component this?

0 likes
10 replies
nexxai's avatar

Why are you disabling CSRF? Livewire updates themselves don't require CSRF, so unless you're completely defeating the purpose of Livewire components by having them manually post to a different route, there shouldn't be any need for what you're trying to do.

1 like
Snapey's avatar

disabling csrf is always a bad idea, in any context.

Im confused why you think its necessary.

1 like
DominikEller's avatar

Got a solutions for Livewire inside of an Iframe? I am facing the same error 419 when trying to update.

Chingy's avatar

@dominikeller @learningraph @cherire Create a middleware that extends the VerifyCsrfToken (if L10 and lower) or go to bootstrap/app.php , in ->withMiddleware() section, do a $middleware->web(replace: ValidateCsrfToken => YourClass and in your custom Middleware override tokensMatch()

Credits here https://github.com/livewire/livewire/discussions/7729

1 like

Please or to participate in this conversation.