From 76878ac5a44d8b907aba1066c0519269208a9bdf Mon Sep 17 00:00:00 2001 From: isaacclad Date: Tue, 21 Jul 2026 22:53:43 +0000 Subject: [PATCH] Fix proxied checkout CSRF for Merchant, Give, Invoice and Events. Public order/pay POSTs hit ladl.link first; satellite CSRF tokens cannot bind to Link (or platform/satellite) sessions, which returned 419 and showed "Could not start checkout." Except public checkout paths and return access_code from owner-gateway Paystack init. Sync contained Paystack sheet. --- bootstrap/app.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/bootstrap/app.php b/bootstrap/app.php index 08ada05..649b1d4 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -13,11 +13,16 @@ return Application::configure(basePath: dirname(__DIR__)) health: '/up', ) ->withMiddleware(function (Middleware $middleware): void { - // Public QR action POSTs land on ladl.link first; CSRF tokens from satellite HTML (Events/Mini) - // do not match Link's session — same failure mode as Laravel 419 Page Expired. + // Public QR/checkout POSTs land on ladl.link first; CSRF tokens rendered in + // satellite HTML (Merchant/Give/Events/Mini/Invoice) do not match Link's + // session — same failure mode as Laravel 419 Page Expired / "Could not start checkout". $middleware->validateCsrfTokens(except: [ '*/register', '*/pay', + '*/order', + '*/booking', + '*/book/order', + 'i/*/pay', ]); $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [