Object Oriented Programming with Laravel - Session 4
1 like270 views
The document provides an overview of object-oriented programming concepts in Laravel including CSRF protection, HTTP requests, PSR-7 requests, HTTP responses, file uploads, and redirects. It discusses how Laravel generates CSRF tokens, including CSRF tokens in forms, and excluding routes from CSRF protection. It also covers accessing the request object, retrieving request data, old input, uploaded files, and generating different types of responses like redirects, views, and file downloads.
Object Oriented Programming with Laravel - Session 4
- 1. Object-Oriented Programming (with Laravel) By: Shahrzad Peyman Session 4 May-2017 [email protected] 1
- 2. 2 Today’s Presentation • CSRF Protection • HTTP Request • PSR-7 Request • HTTP Response
- 3. 3 CSRF Protection Laravel makes it easy to protect your application from cross-site request forgery (CSRF) attacks. Laravel automatically generates a CSRF "token" for each active user session managed by the application. This token is used to verify that the authenticated user is the one actually making the requests to the application.
- 4. CSRF Protection 4 Anytime you define a HTML form in your application, you should include a hidden CSRF token field in the form so that the CSRF protection middleware can validate the request.
- 5. Excluding URIs from CSRF Protection 5 Sometimes you may wish to exclude a set of URIs from CSRF protection. Typically, you should place these kinds of routes outside of the web middleware group that the RouteServiceProvider applies to all routes in the routes/web.php file. However, you may also exclude the routes by adding their URIs to the $expect property of the verifyCSRFToken middleware:
- 6. 6 X-CSRF-TOKEN In addition to checking for the CSRF token as a POST parameter, the verifyCsrfToken middleware will also check for the X-CSRF-TOKEN request header. You could, for example, store the token in a HTML meta tag:
- 7. X-CSRF-TOKEN Then, once you have created the meta tag, you can instruct a library like jQuery to automatically add the token to all request headers. This provides simple, convenient CSRF protection for your AJAX based applications: 7
- 8. HTTP Requests To obtain an instance of the current HTTP request via dependency injection, you should type-hint the IlluminateHTTPRequest class on your controller method. 8
- 9. Request & Route Parameters 9 If your controller method is also expecting input from a route parameter you should list your route parameters after your other dependencies. For example, if your route is defined like so:
- 10. Accessing the Request via Route Closures 10
- 11. Request Path & Methods The IlluminateHTTPRequest instance provides a variety of methods for examining the HTTP request for your application. We will discuss a few of the most important methods below. The path method returns the request's path information. So, if the incoming request is targeted at http://domain.com/foo/bar, the path method will return foo/bar:
- 12. Retrieving the Request URL To retrieve the full URL for the incoming request you may use the url or fullUrl methods.
- 13. Retrieving the Request Method The method method will return the HTTP verb for the request. You may use the isMethod method to verify that the HTTP verb matches a given string:
- 14. PSR-7 Request The PSR-7 standard specifies interfaces for HTTP messages, including requests and responses. If you would like to obtain an instance of a PSR-7 request instead of a Laravel request, you will first need to install a few libraries. Laravel uses the Symfony HTTP Message Bridge component to convert typical Laravel requests and responses into PSR-7 compatible implementations: 14
- 15. PSR-7 Request 15 Once you have installed these libraries, you may obtain a PSR-7 request by type-hinting the request interface on your route Closure or controller method:
- 16. Retrieving Input 16 You may also retrieve all of the input data as an array using the all method:
- 17. Retrieving the portion of Input Data 17
- 18. Determine If an Input Value is Present 18 You should use the has method to determine if a value is present on the request. The has method returns true if the value is present and is not an empty string:
- 19. 19 Old Input Laravel allows you to keep input from one request during the next request. This feature is particularly useful for re-populating forms after detecting validation errors. However, if you are using Laravel's included validation features, it is unlikely you will need to manually use these methods, as some of Laravel's built-in validation facilities will call them automatically. The flash method on the IlluminateHttpRequest class will flash the current input to the session so that it is available during the user's next request to the application:
- 20. 20 Flashing Input then Redirecting Since you often will want to flash input to the session and then redirect to the previous page, you may easily chain input flashing onto a redirect using the withInput method:
- 21. 21 Retrieving Old Input To retrieve flashed input from the previous request, use the old method on the Request instance. The old method will pull the previously flashed input data from the session:
- 22. 22 Files You may access uploaded files from a IlluminateHttpRequest instance using the file method or using dynamic properties. The file method returns an instance of the IlluminateHttpUploaded File class.
- 23. Validating Successful Uploads 23 In addition to checking if the file is present, you may verify that there were no problems uploading the file via the isValid method:
- 24. 24 File Path & Extensions The uploadedFile class also contains methods for accessing the file's fully-qualified path and its extension. The extension method will attempt to guess the file's extension based on its contents. This extension may be different from the extension that was supplied by the client: 24
- 25. 25 File Path & Extensions To store an uploaded file, you will typically use one of your configured filesystems. The UploadedFile class has a store method which will move an uploaded file to one of your disks, which may be a location on your local filesystem or even a cloud storage location like Amazon S3. 25
- 26. 26 HTTP Responses All routes and controllers should return a response to be sent back to the user's browser. Laravel provides several different ways to return responses. The most basic response is simply returning a string from a route or controller. The framework will automatically convert the string into a full HTTP response:
- 27. 27 Response Objects Typically, you won't just be returning simple strings or arrays from your route actions. Instead, you will be returning full IlluminateHttpResponse instances or views.
- 28. 28 Redirects Redirects are instances of the IlluminateHttpRedirectResponse class, and contain the proper headers needed to redirect the user to another URL. There are several ways to generate a RedirectResponse instance. The simplest method is to use the global redirect helper:
- 31. 31 Other Response Types The response helper may be used to generate other types of response instances. If you need control over the response's status and headers but also need to return a view as the response's content, you should use the view method:
- 32. 32 File Downloads The download method may be used to generate a response that forces the user's browser to download the file at the given path. The download method accepts a file name as the second argument to the method, which will determine the file name that is seen by the user downloading the file. Finally, you may pass an array of HTTP headers as the third argument to the method: