Search code examples
laravelcsrfng-flow

laravel 5 CSRF with ngflow upload

I'm trying to use ngflow to upload images via a POST request in Laravel 5 but I'm getting a token mismatch error even though I'm sending the token in the request header (it's there, I checked). So I'm either using a wrong token or this can't be used with ngflow?

this is the js code I use on to send headers:

<html ng-app="app" flow-init="{headers: {'X-CSRF-TOKEN': '<% csrf_token() %>'}}" flow-file-added="!!{jpg:1,jpeg:1,png:1}[$file.getExtension()]">

The only solution I found is to disable the CSRF protection :( The official doc says ajax calls can be used since the laravel middleware check also for headers. So what's wrong?

Solution

  • OK solved it... the reason was my framework/session directory was not owned by the same user as php/nginx so I was getting a different token at every refresh/request instead of one per session.