Laravel 5.4中的TokenMisMatchException

Question

我是Laravel和PHP的新手。我使用POST方法获取用户请求，并在verifyCSRFToken.php第68行中获取TokenMismatchException。检查server.php中的日志发现以下内容。

[2017-06-13 11:29:55] local.ERROR: Symfony\Component\Debug\Exception\FatalThrowableError: Undefined constant 'home' in C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Container\Container.php:762 

堆栈跟踪：

C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Container\Container.php(762): ReflectionClass->newInstanceArgs(Array) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Container\Container.php(608): Illuminate\Container\Container->build('App\\Http\\Middle...') 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Container\Container.php(575): Illuminate\Container\Container->resolve('App\\Http\\Middle...') 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Application.php(72Illuminate\Container\Container->make('App\\Http\\Middle...') 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(138): Illuminate\Foundation\Application->make('App\\Http\\Middle...') 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\View\Middleware\ShareErrorsFromSession.php(49): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\View\Middleware\ShareErrorsFromSession->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Session\Middleware\StartSession.php(64): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Session\Middleware\StartSession->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse.php(37): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Cookie\Middleware\EncryptCookies.php(59): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Cookie\Middleware\EncryptCookies->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(102): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Router.php(576): Illuminate\Pipeline\Pipeline->then(Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Router.php(535): Illuminate\Routing\Router->runRouteWithinStack(Object(Illuminate\Routing\Route), Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Router.php(513): Illuminate\Routing\Router->dispatchToRoute(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Kernel.php(174): Illuminate\Routing\Router->dispatch(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(30): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\TransformsRequest.php(30): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\TransformsRequest.php(30): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\ValidatePostSize.php(27): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode.php(46): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(148): Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode->handle(Object(Illuminate\Http\Request), Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Routing\Pipeline.php(53): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Pipeline\Pipeline.php(102): Illuminate\Routing\Pipeline->Illuminate\Routing\{closure}(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Kernel.php(14 Illuminate\Pipeline\Pipeline->then(Object(Closure)) 
C:\Users\Dikesh Kumar\blog\vendor\laravel\framework\src\Illuminate\Foundation\Http\Kernel.php(11 Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\public\index.php(53): Illuminate\Foundation\Http\Kernel->handle(Object(Illuminate\Http\Request)) 
C:\Users\Dikesh Kumar\blog\server.php(21): require_once('C:\\Users\\Dikesh...') 
{main} 

有人能帮忙吗？

Answer 1

Laravel可以很容易地保护您的应用程序免受跨站点请求伪造（CSRF）攻击。跨站点请求伪造是一种恶意攻击，其中未经授权的命令是代表经过身份验证的用户执行的。

Laravel自动为应用程序管理的每个活动用户会话生成一个CSRF“令牌”。该令牌用于验证经过身份验证的用户是实际向应用程序发出请求的用户。

无论何时，在应用程序中定义HTML表单时，都应该在表单中包含一个隐藏的CSRF标记字段，以便CSRF保护中间件可以验证请求。您可以使用csrf_field助手生成令牌场：

<form method="POST" action="/profile"> 
    {{ csrf_field() }} 
    ... 
</form> 

Reference

Answer 2

你需要在你的meta标签来定义csrf令牌：

<meta name="csrf-token" content="{{ csrf_token() }}"> 

或者你也可以通过为隐藏输入元素：

<input type="hidden" name="_token" value="{{ csrf_token() }}"> 

如果您使用的是ajax，那么你必须定义csrf值：

<script type="text/javascript"> 
     $.ajaxSetup({ 
     headers: { 
      'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content') 
     } 
     }); 
    </script> 

，然后运行以下commnad：

php artisan cache:clear 

Answer 3

我想你说的是你知道如何使用CSRF令牌，但是，过了一段时间你会得到一个令牌不匹配。例如，如果您的登录页面在您的浏览器中已经存在了一段时间，而表单已经生成了令牌（作为隐藏字段），则会发生这种情况。现在，当您尝试填写表单时，您正在使用上次刷新页面时生成的标记（例如：昨天）。在后面，一旦你提交表单，laravel将实例化一个新的标记，并将与该标记进行比较，这将是无效的。

您可以将/app/config/session.php内的会话过期从120分钟更改为比此更长的任何内容。

否则，您可以每120分钟刷新一次HTML元刷新标记，这样当表单处于空闲状态时，可以刷新页面并打印最新的csrf标记。