Readme

Author: binaryk

README.md

@@ -27,20 +27,41 @@ composer require binarcode/laravel-stateless-session
 1. Trigger session, make a GET request to: `/api/csrf-header`. This will return a header with the session key and an optional header with CSRF token `XSRF-TOKEN`. 
 The header name could be configured in: `stateless.header`
 
-2. Use this session key for every request you want to take care of the session.
+2. Use this header session key/value for every request you want to take care of the session.
 
-3. If you want to benefit of the CSRF protection of your requests, you should add the follow middleware to your routes:
+3. If you want to benefit of the CSRF protection of your requests, you should add the follow middlewares to your routes:
 ```php
-->middleware(Binarcode\LaravelStatelessSession\Http\Middleware\VerifyHeaderCsrfToken::class);
+use Binarcode\LaravelStatelessSession\Http\Middleware\StatelessStartSession;
+use Binarcode\LaravelStatelessSession\Http\Middleware\StatelessVerifyCsrfToken;
+
+->middleware([
+    StatelessStartSession::class,
+    StatelessVerifyCsrfToken::class,
+]);
+```
+
+You can create a middleware group in your Http\Kernel with these 2 routes as:
+
+```php
+protected $middlewareGroups = [
+// ...
+    'stateless.csrf' => [
+        StatelessStartSession::class,
+        StatelessVerifyCsrfToken::class,
+    ],
+// ...
+]
 ```
 
-Now the server will return 419 (Page expired code). Unless you send back a request header named: `X-CSRF-TOKEN` with the value received by the first GET request in the `XSRF-TOKEN` header.
+Now the server will return 419 (Page expired code).
+ 
+Unless you send back a request header named: `X-CSRF-TOKEN` with the value received by the first GET request in the `XSRF-TOKEN` header.
 
-That's it.
+Done.
 
-At this point you have CSRF protection. 
+- At this point you have CSRF protection. 
 
-And you can play with `SessionManager` and use the `session()` helper to store/get information (e.g. flash sessions).
+- And you can play with `SessionManager` and use the `session()` helper to store/get information (e.g. flash sessions).
 
 ## Config
 

src/Http/Middleware/StartStatelessSession.php renamed to src/Http/Middleware/StatelessStartSession.php

@@ -9,7 +9,7 @@
 use Illuminate\Session\Store;
 use Symfony\Component\HttpFoundation\Response;
 
-class StartStatelessSession extends StartSession
+class StatelessStartSession extends StartSession
 {
     public function handle($request, Closure $next)
     {

src/Http/Middleware/VerifyHeaderCsrfToken.php renamed to src/Http/Middleware/StatelessVerifyCsrfToken.php

@@ -6,7 +6,7 @@
 use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
 use Illuminate\Session\TokenMismatchException;
 
-class VerifyHeaderCsrfToken extends Middleware
+class StatelessVerifyCsrfToken extends Middleware
 {
     /**
      * Handle an incoming request.

src/LaravelStatelessSessionServiceProvider.php

@@ -2,10 +2,11 @@
 
 namespace Binarcode\LaravelStatelessSession;
 
-use Binarcode\LaravelStatelessSession\Http\Middleware\StartStatelessSession;
-use Illuminate\Support\ServiceProvider;
-use Illuminate\Support\Facades\Route;
 use Binarcode\LaravelStatelessSession\Http\Controllers\CsrfHeaderController;
+use Binarcode\LaravelStatelessSession\Http\Middleware\StatelessStartSession;
+use Binarcode\LaravelStatelessSession\Http\Middleware\StatelessVerifyCsrfToken;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\ServiceProvider;
 
 class LaravelStatelessSessionServiceProvider extends ServiceProvider
 {
@@ -18,7 +19,7 @@ public function boot()
 
         if ($this->app->runningInConsole()) {
             $this->publishes([
-                __DIR__.'/../config/config.php' => config_path('stateless.php'),
+                __DIR__ . '/../config/config.php' => config_path('stateless.php'),
             ], 'config');
         }
     }
@@ -31,7 +32,7 @@ public function register()
         $this->registerSessionManager();
 
         // Automatically apply the package configuration
-        $this->mergeConfigFrom(__DIR__.'/../config/config.php', 'stateless');
+        $this->mergeConfigFrom(__DIR__ . '/../config/config.php', 'stateless');
 
         $this->app->singleton('laravel-stateless-session', function () {
             return new LaravelStatelessSession;
@@ -59,8 +60,11 @@ protected function defineRoutes()
         Route::group(['prefix' => config('stateless.prefix', 'api')], function () {
             Route::get(
                 '/csrf-header',
-                CsrfHeaderController::class.'@show'
-            )->middleware(StartStatelessSession::class);
+                CsrfHeaderController::class . '@show'
+            )->middleware([
+                StatelessStartSession::class,
+                StatelessVerifyCsrfToken::class,
+            ]);
         });
     }
 }