From 18b0a6a66158cb506c956722d890d1a2d0725401 Mon Sep 17 00:00:00 2001 From: Ryan Mitchell Date: Thu, 3 Sep 2026 10:16:28 +0100 Subject: [PATCH] Add PreventRequestForgery to webhook middleware exclusions --- routes/actions.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/routes/actions.php b/routes/actions.php index d1367af..091e2c1 100644 --- a/routes/actions.php +++ b/routes/actions.php @@ -28,7 +28,12 @@ Route::get('oauth-redirect', fn () => redirect()->route('statamic.cp.shopify.index')); Route::prefix('webhook') - ->withoutMiddleware(['App\Http\Middleware\VerifyCsrfToken', 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken']) + ->withoutMiddleware([ + 'App\Http\Middleware\VerifyCsrfToken', + 'Illuminate\Foundation\Http\Middleware\VerifyCsrfToken', + 'Illuminate\Foundation\Http\Middleware\ValidateCsrfToken', + 'Illuminate\Foundation\Http\Middleware\PreventRequestForgery', + ]) ->middleware([VerifyShopifyHeaders::class]) ->group(function () { Route::post('collection/create', [Webhooks\CollectionCreateUpdateController::class, 'create'])