Skill v1.0.3

version: "1.0.3"

Assuming the forms use Laravel’s web routes, CSRF protection is enabled by the web middleware and CSRF middleware by default.

Add @csrf inside every Blade form:

<form method="POST" action="{{ route('posts.store') }}">
    @csrf
 
    <!-- fields -->
 
    <button type="submit">Save</button>
</form>

For PUT, PATCH, or DELETE forms, include both directives:

<form method="POST" action="{{ route('posts.destroy', $post) }}">
    @csrf
    @method('DELETE')
 
    <button type="submit">Delete</button>
</form>

Do not disable CSRF globally. Exclude only trusted third-party callbacks, such as /webhook, when necessary:

->withMiddleware(function ($middleware) {
    $middleware->validateCsrfTokens(except: [
        '/webhook',
    ]);
});

Ensure the routes remain in routes/web.php or otherwise use the web middleware.