为什么我会收到来自 Laravel 8 CsrfMiddleware 保护端点的 419 响应？

时间：2021-04-02 18:39:26

标签： laravel-8 laravel-sanctum

我最近按照 Laravel 8 上的说明创建了一个新的 Laravel 8 项目。 x sanctum 文档页面。

现在，根据本指南，应该使用 CSRF 保护，这意味着调用 <app_url>/sanctum/csrf-cookie，这将返回加密的 XSRF-TOKEN cookie。然后应该使用此 cookie 的值在每个请求之前设置 X-XSRF-TOKEN 请求标头。

我的情况：我在 Docker 容器中本地运行 Laravel，并且打算仅将其用作 API；也就是说，我将有一个 Vue SPA 与我的 Laravel 后端对话。但是现在，我正在使用 Insomnia 测试 API。我希望这能奏效，它与 SPA 本质上没有区别。

我有一个测试路由，默认情况下受 CSRF 中间件保护，因为它在 api.php 文件中：

Route::prefix('v1')->group(function () {

    /**
     * get the health of the endpoint,
     * can be used to see if API is up and running
     */
    Route::post('health', function (Request $request) {
        return ['healthy' => true];
    });˜
}

我可以成功调用 /sanctum/csrf-cookie 端点并接收 XSRF-COOKIE，到目前为止一切顺利。当我尝试调用 api/v1/health 端点时，我总是收到 419 响应。

一些相关设置：

.env

SESSION_DRIVER=cookie
SESSION_DOMAIN=localhost
SESSION_LIFETIME=480

cors.php

'paths' => ['*'], //  ['api/*']
'allowed_methods' => ['*'],
'allowed_origins' => ['*'],
'allowed_origins_patterns' => [],
'allowed_headers' => ['*'],
'exposed_headers' => ['*'],
'max_age' => 0,
'supports_credentials' => true,

sanctum.php

'stateful' => explode(',', env(
    'SANCTUM_STATEFUL_DOMAINS',
    'localhost,localhost:80,localhost:3000,localhost:8080,localhost:8085,127.0.0.1,127.0.0.1:8000,127.0.0.1:8085,::1'
)),



'middleware' => [
    'verify_csrf_token' => App\Http\Middleware\VerifyCsrfToken::class,
    'encrypt_cookies' => App\Http\Middleware\EncryptCookies::class,
],

我试过了：

  • 在所有相关文件中禁用 cookie 加密
  • 完全省略 .env 中的会话域（因此它在 session.php 中变为 null）
  • 在 .env 中将会话域设置为空 (SESSION_DOMAIN=)
  • 设置 X-CSRF-TOKEN 标头而不是 X-XSRF-TOKEN 标头

似乎没有任何影响。 api/v1/health 端点的相关请求标头：

X-XSRF-TOKEN=<XSRF-TOKEN-COOKIE-VALUE>
Accept=application/json

堆栈跟踪：

{
  "message": "CSRF token mismatch.",
  "exception": "Symfony\\Component\\HttpKernel\\Exception\\HttpException",
  "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
  "line": 372,
  "trace": [
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Exceptions/Handler.php",
      "line": 317,
      "function": "prepareException",
      "class": "Illuminate\\Foundation\\Exceptions\\Handler",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Routing/Pipeline.php",
      "line": 51,
      "function": "render",
      "class": "Illuminate\\Foundation\\Exceptions\\Handler",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 172,
      "function": "handleException",
      "class": "Illuminate\\Routing\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php",
      "line": 121,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php",
      "line": 63,
      "function": "handleStatefulRequest",
      "class": "Illuminate\\Session\\Middleware\\StartSession",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Session\\Middleware\\StartSession",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php",
      "line": 37,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Cookie\\Middleware\\AddQueuedCookiesToResponse",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php",
      "line": 67,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Cookie\\Middleware\\EncryptCookies",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/sanctum/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php",
      "line": 26,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 149,
      "function": "Laravel\\Sanctum\\Http\\Middleware\\{closure}",
      "class": "Laravel\\Sanctum\\Http\\Middleware\\EnsureFrontendRequestsAreStateful",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 103,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/sanctum/src/Http/Middleware/EnsureFrontendRequestsAreStateful.php",
      "line": 34,
      "function": "then",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Laravel\\Sanctum\\Http\\Middleware\\EnsureFrontendRequestsAreStateful",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 103,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
      "line": 695,
      "function": "then",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
      "line": 670,
      "function": "runRouteWithinStack",
      "class": "Illuminate\\Routing\\Router",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
      "line": 636,
      "function": "runRoute",
      "class": "Illuminate\\Routing\\Router",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Routing/Router.php",
      "line": 625,
      "function": "dispatchToRoute",
      "class": "Illuminate\\Routing\\Router",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
      "line": 166,
      "function": "dispatch",
      "class": "Illuminate\\Routing\\Router",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 128,
      "function": "Illuminate\\Foundation\\Http\\{closure}",
      "class": "Illuminate\\Foundation\\Http\\Kernel",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php",
      "line": 21,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php",
      "line": 21,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Foundation\\Http\\Middleware\\TransformsRequest",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php",
      "line": 27,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Foundation\\Http\\Middleware\\ValidatePostSize",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php",
      "line": 86,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Illuminate\\Foundation\\Http\\Middleware\\PreventRequestsDuringMaintenance",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/fruitcake/laravel-cors/src/HandleCors.php",
      "line": 57,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Fruitcake\\Cors\\HandleCors",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/fideloper/proxy/src/TrustProxies.php",
      "line": 57,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Fideloper\\Proxy\\TrustProxies",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/spatie/laravel-http-logger/src/Middlewares/HttpLogger.php",
      "line": 28,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 167,
      "function": "handle",
      "class": "Spatie\\HttpLogger\\Middlewares\\HttpLogger",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php",
      "line": 103,
      "function": "Illuminate\\Pipeline\\{closure}",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
      "line": 141,
      "function": "then",
      "class": "Illuminate\\Pipeline\\Pipeline",
      "type": "->"
    },
    {
      "file": "/var/www/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php",
      "line": 110,
      "function": "sendRequestThroughRouter",
      "class": "Illuminate\\Foundation\\Http\\Kernel",
      "type": "->"
    },
    {
      "file": "/var/www/public/index.php",
      "line": 52,
      "function": "handle",
      "class": "Illuminate\\Foundation\\Http\\Kernel",
      "type": "->"
    }
  ]
}

知道这里发生了什么吗？

0 个答案:

没有答案
相关问题
最新问题