Exempt Mini Pay POSTs from Link CSRF checks.

Proxied ladl.link/{slug}/pay requests carry CSRF tokens from Mini HTML, which cannot bind to Link's session — the same 419 failure mode as event registration. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 23:11:59 +00:00
parent fe268e7bfa
commit 520284d766
2 changed files with 45 additions and 1 deletions
@@ -13,9 +13,11 @@ return Application::configure(basePath: dirname(__DIR__))
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
-        // Public event registration POSTs land on ladl.link first; CSRF tokens from Events HTML do not match here.
+        // Public QR action POSTs land on ladl.link first; CSRF tokens from satellite HTML (Events/Mini)
+        // do not match Link's session — same failure mode as Laravel 419 Page Expired.
        $middleware->validateCsrfTokens(except: [
            '*/register',
+            '*/pay',
        ]);

        $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [