Only check CSRF on page requests

PhpGt · Sep 11, 2019 · 1847950 · 1847950
1 parent c0fa6eb
commit 1847950
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/src/Lifecycle.php b/src/Lifecycle.php
@@ -11,7 +11,9 @@
 use Gt\Database\Database;
 use Gt\Http\ServerInfo;
 use Gt\Http\RequestFactory;
+use Gt\WebEngine\Dispatch\PageDispatcher;
 use Gt\WebEngine\FileSystem\Path;
+use Gt\WebEngine\Route\PageRouter;
 use Psr\Http\Message\RequestInterface;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
@@ -104,9 +106,12 @@ public function start():void {
 			true
 			)
 		);
-		$csrfProtection->processAndVerify(
-			$input->getAll(Input::DATA_BODY)
-		);
+
+		if($router instanceof PageRouter) {
+			$csrfProtection->processAndVerify(
+				$input->getAll(Input::DATA_BODY)
+			);
+		}
 
 		$dispatcher = $this->createDispatcher(
 			$config,