From 58422ff26687ebf412aa9065a3e718972d985c05 Mon Sep 17 00:00:00 2001
From: Mustafa Yildiz <mstfyldz@gmail.com>
Date: Fri, 21 Aug 2026 18:48:53 +0300
Subject: [PATCH] fix(csrf): exclude tracking endpoints from csrf verification
 to prevent 419 errors

---
 bootstrap/app.php | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/bootstrap/app.php b/bootstrap/app.php
index c2e4939..665ac6e 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -35,8 +35,12 @@ return Application::configure(basePath: dirname(__DIR__))
         $middleware->web(\App\Http\Middleware\BotDetector::class);
         // SEO yönlendirmeleri
         $middleware->web(\App\Http\Middleware\SeoRedirectMiddleware::class);
-        // iyzico callback CSRF muaf
-        $middleware->validateCsrfTokens(except: ['checkout/callback']);
+        // iyzico callback ve arka plan izleme metrikleri (beacon/fetch) CSRF muaf
+        $middleware->validateCsrfTokens(except: [
+            'checkout/callback',
+            'track/*',
+            'api/*',
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //