for testing and deploying your application
for finding and fixing issues
for empowering human code reviews
<?php
namespace WPB\App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
class VerifyCsrfToken
{
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle(Request $request, Closure $next)
$token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');
$action = $request->wpb_nonce ?: 'wpb_nonce';
if ( !wp_verify_nonce( $token, $action ) ) {
wp_verify_nonce
If this is a false-positive, you can also ignore this issue in your code via the ignore-call annotation
ignore-call
if ( !/** @scrutinizer ignore-call */ wp_verify_nonce( $token, $action ) ) {
if ($request->ajax()) {
return wp_send_json(["message" => "CSRF Token mitchmatch"], 403 );
wp_send_json
return /** @scrutinizer ignore-call */ wp_send_json(["message" => "CSRF Token mitchmatch"], 403 );
}
throw new \Exception("CSRF Token mismatch");
return $next($request);