Laravel如何接收处理外部POST请求？是否需CSRF Token？

Hey there! Let's break down your problem step by step and figure out why your external POST request isn't working as expected.

First off, your hunch about CSRF tokens is understandable—but Laravel's api.php routes are not protected by CSRF validation by default. Routes defined in api.php use the api middleware group, which excludes the VerifyCsrfToken middleware (that's only applied to routes in web.php). So CSRF isn't the culprit here.

Let's walk through the most likely issues and fixes:

1. Verify the Request is Reaching Your Laravel App #

First, confirm if the request is even hitting your controller. Add a simple log entry at the start of your insertViaRequest method:

public function insertViaRequest(Request $request)
{
    Log::info('Received external request data:', $request->all());
    // Rest of your code...
}

Check your Laravel log file (storage/logs/laravel.log). If you don't see this log entry, the request isn't reaching your app at all. To debug the external CURL call, add error handling to the external site's code:

// After curl_exec($ch)
if (curl_errno($ch)) {
    echo 'CURL Error: ' . curl_error($ch);
}
curl_close($ch);

This will tell you if there's a connection issue, invalid URL, or other CURL-specific problem.

2. Add Validation & Error Logging for Your Model #

Your current code doesn't validate incoming data or log why the save might fail. Update your controller method to catch issues explicitly:

public function insertViaRequest(Request $request)
{
    // Validate required fields first
    $validatedData = $request->validate([
        'firstname' => 'required|string',
        'lastname' => 'required|string',
        'email_address' => 'required|email',
    ]);

    $user = new Candidates;
    $user->firstname = $validatedData['firstname'];
    $user->lastname = $validatedData['lastname'];
    $user->email_address = $validatedData['email_address'];
    $user->created_by = 1;

    if ($user->save()) {
        Log::info('Candidate saved successfully:', ['id' => $user->id]);
        return response()->json(['status' => 'success'], 200);
    } else {
        // Log exact validation errors from the model
        Log::error('Failed to save candidate:', $user->getErrors()->toArray());
        return response()->json(['status' => 'error', 'message' => $user->getErrors()], 400);
    }
}

If validation fails, Laravel will automatically return a 422 error with details, and the logs will show exactly what went wrong during the save.

3. Check Your Model's Fillable Attributes #

This is a super common gotcha! Your Candidates model must explicitly list which fields can be mass-assigned using the $fillable property. Without this, Laravel's mass-assignment protection will block the save:

class Candidates extends Model
{
    protected $fillable = ['firstname', 'lastname', 'email_address', 'created_by'];
    // Rest of your model code...
}

If you forget this, the save will silently fail (or throw an exception depending on your Laravel version).

4. Confirm Your CURL Request's Content-Type #

Your current CURL code sends data as application/x-www-form-urlencoded (via http_build_query), which Laravel should parse correctly, but you can explicitly set the header to avoid any ambiguity:

// Add this to your CURL options
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/x-www-form-urlencoded',
));

Alternatively, you can try sending data as JSON (a common standard for API requests):

// Replace the $data and postString parts of your CURL code
$data = json_encode([
    'firstname' => $name_first,
    'lastname' => $name_last,
    'email_address' => $email,
    'method' => 4
]);

curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
));

Laravel will automatically parse JSON requests into the $request object, so your controller code won't need changes for this.

5. Double-Check Database Table & Fields #

Make sure your candidates database table has all the fields you're trying to save (firstname, lastname, email_address, created_by) and that their data types match what you're sending (e.g., email_address is a string, created_by is an integer). Mismatched types will cause the save to fail.

Start with adding logs and validation—this will give you clear visibility into where the process is breaking down.

内容的提问来源于stack exchange，提问作者S_R