isaacclad/ladill-mini
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Exempt public Payment QR POSTs from CSRF checks.
Deploy Ladill Mini / deploy (push) Successful in 1m27s
Details

Browse Source 
Browser sessions stay on ladl.link while Pay is proxied server-side to Mini without cookies, so satellite CSRF tokens cannot bind.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
isaacclad
2026-07-13 23:12:16 +00:00
co-authored by Cursor
parent a2bf4f435f
commit 67470badb8
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bootstrap/app.php
+6
View File
@@ -13,6 +13,12 @@ return Application::configure(basePath: dirname(__DIR__))
health: '/up', health: '/up',
) )
->withMiddleware(function (Middleware $middleware): void { ->withMiddleware(function (Middleware $middleware): void {
// Public Payment QR POSTs are proxied ladl.link → platform → Mini without the
// browser session cookie; satellite-rendered CSRF tokens cannot bind here.
$middleware->validateCsrfTokens(except: [
'q/*/pay',
]);
$middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [ $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
'redirect' => $request->fullUrl(), 'redirect' => $request->fullUrl(),
])); ]));