Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
554 views
in Technique[技术] by (71.8m points)

jquery - Laravel 4 CSRF form submit through Ajax call

I'm new to both Stackoverflow and Laravel 4, I am trying to submit a form through jquery ajax. I serializeArray() the form and use json to submit it. In laravel, in the routes I check the csrf token submitted, the go to my controller for process inputs. The csrf check doesn't work when the _token input is in an array as with serializeArray(). I have to get the _token value and submit is as a seperate ajax data. I'm wondering if there is a way to tell csrf filter where ever its running to check the input array for hte field _token and use that? here is my code:

routes.php

Route::post('searchAjax', array('before' => 'csrf', 
                                'uses' => 'SearchController@searchAjax'));

This is where I wan't it to read the array form[0]['_token] but I don't know how to tell it to do that.

index.js
    var form = $('#search').serializeArray();
var token = $('#search > input[name="_token"]').val();
$.ajax({
    type: 'post',
    url: 'searchAjax',
    dataType: 'json',
    data: { _token: token, form: form },
    success: function(data) {
        for(var key in data)
        {
            //alert(key)
        }
        //alert(data.message);
    }
});

I want to get rid of { _token: token, form: form } in the ajax call and just have 'form' that is an array with _token in it already. here is the html:

<form id="search" class="form-horizontal" accept-charset="UTF-8" action="http://testing:998/search" method="POST">
  <input type="hidden" value="6GBbv9LmnOdL8UcOsm8DDJ4Bfi6eGcQRlC9SPdL4" name="_token">
<div class="control-group">
  <label class="control-label" for="title">Book Titles</label>
  <div class="controls">
    <input id="title" class="input" type="text" value="click to search book titles" name="title">
  </div>
</div>
<div class="control-group">
<div class="control-group">
<div class="control-group">
</form>

Thank you in advance. :)

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

Another option is to use the approach outlined by Kelt Dockins which is to send the token in the headers using jquery, eg. somewhere in your jquery/javascript bootstrapping add:

$.ajaxSetup({
    headers: {
        'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content')
    }
});

This will get the CSRF token from a header meta data tag and include it in the headers of each ajax request. Then you need to add the metadata and token into your Laravel templates, eg.

<head>
    <title>My Page</title>
    <meta name="csrf-token" content="<?= csrf_token() ?>">

You also need to modify the CSRF filter to check the ajax request header as well the default Input::get('_token')

Route::filter('csrf', function()

{
   $token = Request::ajax() ? Request::header('X-CSRF-Token') : Input::get('_token');
   if (Session::token() != $token) {
      throw new IlluminateSessionTokenMismatchException;
   }
});

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...