Question

当我启用我的路线（登录，主页等）时，有人可以解释以下行为：

Route::group(['middleware' => 'web'], function () {
    ....
});

Ajax登录模式工作正常，但是当我尝试以下（在控制器中启用中间件）时，我更喜欢使用它：

class PagesController extends Controller
{
    public function __construct()
    {
        $this->middleware('web');
    }
    ...
}

class AuthController extends Controller
{
    public function __construct()
    {
        $this->middleware('web');
        $this->middleware('guest', ['except' => 'logout']);
    }
    ...
}

在VerifyCsrfToken.php第67行中输入了TokenMismatchException。据我所知，这两种方法应该没有区别，我在这里做错了什么？

csrf令牌设置：

基础布局：

<meta name="csrf-token" content="{{ csrf_token() }}">

modal js：

var options = {
  emulateJSON: true,
  headers: {
    'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
  }
};

Answer 1

我会给你一个工作榜样，从中获取有助于你的想法：

应用程序/ HTTP / routes.php文件：

// all routes that start with: "/auth" are not filtered by any middleware
Route::group(['prefix' => 'auth'], function() {
    Route::get('/', ['as' => 'auth', 'uses' => 'AuthController@index']);
    Route::post('/', ['as' => 'auth.attempt', 'uses' => 'AuthController@attempt']);
    Route::delete('/', ['uses' => 'AuthController@destroy']);
    Route::any('destroy', ['as' => 'auth.destroy', 'uses' => 'AuthController@destroy']);
});

// all routes that start with: "/billing" will be handled by this group (prefix => 'billing')
// all controllers inside this route group are located in 'Billing' namespace
// all routes in this group are pre-checked by middleware 'HasAccessToBilling'
Route::group(['prefix' => 'billing', 'namespace' => 'Billing', 'middleware' => ['App\Http\Middleware\HasAccessToBilling']], function()
{
    Route::any('/', ['as' => 'billing', 'uses' => 'DashboardController@index']);

    Route::get('profile', ['as' => 'billing.profile', 'uses' => 'ProfileController@index']);

    // TARIFFS
    Route::group(['prefix' => 'tariffs'], function() {
        Route::get('/', ['as' => 'billing.tariffs', 'uses' => 'TariffsController@index']); // showing page with tariffs paginated 
        Route::get('all', ['as' => 'billing.tariffs.all', 'uses' => 'TariffsController@all']); // listing all tariffs with json (see controller)

        Route::get('create', ['as' => 'billing.tariffs.create', 'uses' => 'TariffsController@create']); // create form
        Route::post('/', ['as' => 'billing.tariffs.store', 'uses' => 'TariffsController@store']); // creating

        Route::get('{id}', ['as' => 'billing.tariffs.edit', 'uses' => 'TariffsController@edit']); // edit form
        Route::post('{id}', ['as' => 'billing.tariffs.update', 'uses' => 'TariffsController@update']); // updating

        Route::get('{id}/activate', ['as' => 'billing.tariffs.activate', 'uses' => 'TariffsController@activate']); // active = 1
        Route::get('{id}/suspend', ['as' => 'billing.tariffs.suspend', 'uses' => 'TariffsController@suspend']); // active = 0
        Route::get('{id}/delete', ['as' => 'billing.tariffs.delete', 'uses' => 'TariffsController@delete']); // deleted = 1
    });

应用程序/ HTTP /中间件/ HasAccessToBilling.php：

<?php namespace App\Http\Middleware;

use App\Library\Auth;
use Closure;
use Illuminate\Http\Request;

class HasAccessToBilling
{

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request $request
     * @param  \Closure $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        if (Auth::hasAccessTo('billing', $request)) {
            return $next($request);
        }
        return redirect()->route('auth');
    }
}

应用程序/资源库/ Auth.php：

<?php namespace App\Library;

use \App\Models\User;
use Illuminate\Http\Request;
use Crypt;

class Auth
{

    public static function recoverSession(Request $request)
    {
        $rememberToken = $request->cookie('remember-token', null);
        if(is_null($rememberToken)) {
            return null;
        }

        try{
            $rememberToken = Crypt::decrypt($rememberToken);
            $auth = json_decode($rememberToken, true);
            $request->session()->set('auth', $auth);
        }
        catch(\Exception $ex) {}

        return $request->session()->get('auth');
    }

    public static function hasAccessTo($realm, Request $request)
    {
        $auth = $request->session()->get('auth', null);
        if (is_null($auth)) {
            $auth = self::recoverSession($request);
        }

        return (isset($auth['access_to']))?
                in_array($realm, $auth['access_to'])
                : false;
    }
}

最后是示例控制器：

查看名称空间＆＃39;结算＆＃39;必须与文件夹相同，否则您将在作曲家中进行手动类别名。

应用程序/ HTTP /控制器/结算/ TariffsController.php：

<?php namespace App\Http\Controllers\Billing;

use Illuminate\Http\Request;
use Redirect;
use App\Http\Controllers\Controller;
use App\Models\Tariff as Model;

class TariffsController extends Controller
{

    /**
     * Listing records
     * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View
     */
    public function index()
    {
        $records = Model::paginate();
        return view('billing.tariffs.index', compact('records'));
    }

    /**
     * Listing all tariff plans as json
     * @return \Illuminate\Http\JsonResponse
     */
    public function all()
    {
        return $this->ok(Model::all());
    }

总结：

如果您在Route::group中定义了中间件 - 那么就不需要在构造函数中调用中间件。路由组的想法是释放您在编写路由时，在使用中间件等进行访问时重复代码。
如果不是公共访问的中间件，如果它不是内部网的应用程序，则不能保护auth控制器。所以你可以在我的路线文件中看到我没有为＆＃34; / auth＆＃34;定义中间件。前缀路由。
我没有使用csrf代币（我没有看到任何理由，多年的工作我从来没有得到csrf有用或挽救我生命的那一刻），所以我已将其从Kernel.php删除。

auth控制器中的Laravel 5.2 Web中间件导致csrf令牌不匹配

1 个答案: