How to use Postman for Laravel $_POST request

Question

How can I try sending a post request to a Laravel app with Postman?

Normally Laravel has a csrf_token that we have to pass with a POST/PUT request. How can I get and send this value in Postman? Is it even possible without turning off the CSRF protection?

Answer 1

Edit:

Ah wait, I misread the question. You want to do it without turning off the CSRF protection? Like Bharat Geleda said: You can make a route that returns only the token and manually copy it in a _token field in postman.

But I would recommend excluding your api calls from the CSRF protection like below, and addin some sort of API authentication later.

Which version of laravel are you running?

Laravel 5.2 and up:

Since 5.2 the CSRF token is only required on routes with web middleware. So put your api routes outside the group with web middleware.

See the "The Default Routes File" heading in the documentation for more info.

Laravel 5.1 and 5.2:

You can exclude routes which should not have CSRF protection in the VerifyCsrfToken middleware like this:

class VerifyCsrfToken extends BaseVerifier
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'api/*',
    ];
}

See the "Excluding URIs From CSRF Protection" heading documentation for more info.

Answer 2

If you store your sessions in Cookies, you can grab the Cookie from an auth request in Developer Tools.

Copy and paste that Cookie in the Header of your POSTMAN or Paw requests.

This approach allows you to limit your API testing to your current session.

Answer 3

1.You can create a new route to show the csrf token using your controller with help of the function below. (Use a Get request on the route)

   public function showToken {
      echo csrf_token(); 

    }

2.Select the Body tab on postman and then choose x-www-form-urlencoded.
3.Copy the token and paste in postman as the value of the key named _token.
4.Execute your post request on your URL/Endpoint

Answer 4

In the headers, add the cookies, before making request, the XSRF-TOKEN cookie and the app cookie. I.e yourappname_session

Answer 5

In laravel, 5.3. Go to app/Http/Kernel.php find middlewareGroups then comment VerifyCsrfToken. Because it executes all middleware before service your request.

protected $middlewareGroups = [
            'web' => [
                \App\Http\Middleware\EncryptCookies::class,
                \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
                \Illuminate\Session\Middleware\StartSession::class,
                \Illuminate\View\Middleware\ShareErrorsFromSession::class,
               ***// \App\Http\Middleware\VerifyCsrfToken::class,***
                \Illuminate\Routing\Middleware\SubstituteBindings::class,
            ],

            'api' => [
                'throttle:60,1',
                'bindings',
            ],
        ];