fix(csrf): exclude tracking endpoints from csrf verification to prevent 419 errors

2026-08-21 18:48:53 +03:00
parent ee0fdd587c
commit 58422ff266
1 changed files with 6 additions and 2 deletions
@@ -35,8 +35,12 @@ return Application::configure(basePath: dirname(__DIR__))
        $middleware->web(\App\Http\Middleware\BotDetector::class);
        // SEO yönlendirmeleri
        $middleware->web(\App\Http\Middleware\SeoRedirectMiddleware::class);
-        // iyzico callback CSRF muaf
-        $middleware->validateCsrfTokens(except: ['checkout/callback']);
+        // iyzico callback ve arka plan izleme metrikleri (beacon/fetch) CSRF muaf
+        $middleware->validateCsrfTokens(except: [
+            'checkout/callback',
+            'track/*',
+            'api/*',
+        ]);
    })
    ->withExceptions(function (Exceptions $exceptions): void {
        //