Function verify 

pub async fn verify(session: Session, request: Request, next: Next) -> Response

Verifies the CSRF token on state-changing requests (POST/PUT/PATCH/ DELETE) against the value stored in the session, rejecting with 419 (Laravel’s own status code for this) on mismatch.

Checks the X-CSRF-TOKEN header first, before touching the body at all - matching Laravel’s own VerifyCsrfToken middleware, which checks this header ahead of a form field for exactly the same reason: a JS-driven request (fetch/XMLHttpRequest, not a submitted <form>) has nowhere else to put the token, and reading it needs no assumption about the body’s content type at all. This is also what makes uploads through this middleware possible in the first place - a header-present request never reaches the body-read/2MB-cap path below, so a multipart file (routinely well over 2MB, and never form-urlencoded) isn’t capped or misparsed here; the actual body is handled downstream by whatever extractor the route uses. If the header is present, it’s the only source checked (present-but-wrong rejects immediately - this is deliberately not “check header, then also check body if that fails”, which would make the two sources ambiguous about which is authoritative).

Falls back to reading the whole body and checking the submitted _csrf_token form field only when the header is absent - unchanged from before, still assumes application/x-www-form-urlencoded for that path (matching plain <form> submissions, the only thing that ever relied on it) - then reconstructs the request with the same bytes so downstream extractors (FormRequest) can still parse it normally.