4 years ago

Category: Laravel, javascript

TL;DR — with a standard config, EZproxy filters out headers with the names X-CSRF-TOKEN and X-XSRF-TOKEN. Any CSRF validation checks that require one of those headers to be present in a request will fail. I wanted to write something about this because my googling for the terms CSRF and EZproxy returned nothing of any use, so maybe this will help someone.

It turned out they were getting 419 errors, which is Laravel’s non-standard response denoting a CSRF validation failure.

EZproxy provides configuration options for how it deals with headers — described here — and those let you nominate specific headers to be passed through unaltered.