The form field / query param name a template’s @csrf directive emits
and this middleware checks - matches Laravel’s own _token convention
closely enough to be recognizable, kept distinct (_csrf_token) so it
doesn’t collide with an app’s own token field.
The header a JS-driven request (fetch/XMLHttpRequest) can send the
token in instead of a form field - matches Laravel’s own X-CSRF-TOKEN
convention, typically sourced from a <meta name="csrf-token"> tag.
HeaderMap::get is case-insensitive, so the exact casing here doesn’t
matter for matching, only for what a client sees if it inspects the name.
Returns the current session’s CSRF token, generating and storing one on
first use. Read this to embed the token in a form (the @csrf
directive does this automatically for templates that pass csrf_token
in their view! context).
Verifies the CSRF token on state-changing requests (POST/PUT/PATCH/
DELETE) against the value stored in the session, rejecting with 419
(Laravel’s own status code for this) on mismatch.