So the next middleware we can create is a cas ref middleware.
So the automatic token verification there are a lot of benefits to that.
We can for example remove this code from controllers.
And the best thing is we won't have to remember about adding this verification.
As you might remember that generating the token is just not enough.
We need to actual CSRF verification.
Otherwise, well, the protection just isn't there.
So to be really safe for this verification, the CSRF protection to be well, to make a lot of sense,
we should just create a middleware that is always run, because our implementation is also making sure
that it is a Post request, or at least that it is not a Get request.
So let me make this middleware.
This is app Middlewares and the class name is CSRF.
Or maybe instead I'm just going to copy an existing implementation.
Like this one to make it quicker.
So this one was called off.
We don't need this name.
This is CSS ref.
We need to import the middleware interface and the implementation.
We're going to move it from comment controller.
So it needs to be removed from this file.
It should now happen automatically.
So we need to make sure that we've got the proper service class.
So we've got this import with an alias.
We also lack the router import.
And I think it's everything that we need.
We just need to verify if the token is valid.
And display the page expired.
If that's not the case let's go back to command controller.
Let's make sure everything is saved.
Next up, let me go to routes as that's the place where we register the middleware.
And let me just add the global middleware that will be called CSF.
We just pass the class name and we should be done.
Now at this point every single form that we submit just needs to have a token generated like in this
login form for example.
Because if we won't have that then this verification should automatically fail.
So before I test signing in, let me go to auth controller to just make sure we don't have the manual
verification.
We do.
That's why I need to remove it first because the verification regenerates the token after we verify
it.
So if we do it twice well we should.
Well we would never be verified because as soon as we verify, we regenerate the token.
So the next verification fails.
And as you see, we just removed the code, which is probably my favorite thing in coding.
If I can remove the excessive code after this change, I should be safely signing in using my favorite
account.
Everything is fine, so it confirms we were well.
We are verifying this CSRF token.
Maybe I'm going to also remove it here and show you in the terminal that it is indeed run.
Let's log out.
And here's another problem.
So the logout is sending a form.
Okay so here is our logout button.
And this means we need the CSRF token here as well.
Otherwise signing on signing out won't work.
Let me try again.
Or maybe actually let's refresh the page and now log out.
So as you see, every single form with a post method needs to have a token.
Otherwise we have an issue.
Now what I really didn't like the error that we've seen when we sign out.
And this just stemmed from the lack of token that wasn't generated.
So let's fix that so that we get a clear 419 page, not some random errors.
So I think the issue was inside this verify method.
And one of the functions I guess that was hash equals didn't like to get a null value.
It just needs to have two strings.
Let's fix this.
So if we don't have a token, we default the token to null, which probably is a mistake.
Let's make it the backup value of an empty string, and also if there is no token in the session, let's
make sure it is an empty string instead.
So not to compare two empty strings.
If there is no token in the session and no token is sent through the form, let's first make sure this
is not empty and empty string would return true when we call the empty function, so the token needs
to be non empty only then we compare it with whatever is inside the session.
I think it is much better now, so if I remove the token generated on this login form so we can test
the functionality, we shouldn't have a token right now and we've got 419 automatically.
This means we are not handling the token.
Let me bring it back.
And now I should be able to sign in sign out.
And I should also be able to post a comment.
And this user verification should automatically work.