Exempt public Payment QR POSTs from CSRF checks.

Browser sessions stay on ladl.link while Pay is proxied server-side to Mini without cookies, so satellite CSRF tokens cannot bind. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-13 23:12:16 +00:00
parent a2bf4f435f
commit 67470badb8
1 changed files with 6 additions and 0 deletions
@@ -13,6 +13,12 @@ return Application::configure(basePath: dirname(__DIR__))
        health: '/up',
    )
    ->withMiddleware(function (Middleware $middleware): void {
+        // Public Payment QR POSTs are proxied ladl.link → platform → Mini without the
+        // browser session cookie; satellite-rendered CSRF tokens cannot bind here.
+        $middleware->validateCsrfTokens(except: [
+            'q/*/pay',
+        ]);
+
        $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
            'redirect' => $request->fullUrl(),
        ]));