Request Forgery Protection

Protect state-changing routes from cross-site request forgery. Laravel 13 formalizes this as PreventRequestForgery, adding origin-aware verification (Sec-Fetch-Site) on top of token-based CSRF.

Commands

# Blade forms still emit tokens
<form method="POST" action="/profile">
    @csrf
    ...
</form>

# Laravel 13+: reference the new middleware class
use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;   // was: VerifyCsrfToken

->withoutMiddleware([PreventRequestForgery::class]);