php - How does laravel load balancing implement csrf defense?

Question

Laravel enables csrf by default, using csrf_token() to generate a random string and save it in the browser and session file. Then find the corresponding session file based on the cookie returned by the browser, and obtain the token for comparison. But the problem is if Use load balancing and configure several servers...

黄舟 · Answer

The session is stored in the database and can be shared after being stored in the database

为情所困 · Answer

This has nothing to do with nginx, what you need is to modify the Session Driver


    /*
    |--------------------------------------------------------------------------
    | Default Session Driver
    |--------------------------------------------------------------------------
    |
    | This option controls the default session "driver" that will be used on
    | requests. By default, we will use the lightweight native driver but
    | you may specify any of the other wonderful drivers provided here.
    |
    | Supported: "file", "cookie", "database", "apc",
    |            "memcached", "redis", "array"
    |
    */

    'driver' => env('SESSION_DRIVER', 'file');