我正在尝试制作一个VueJs表单以包含在php.blade文件中，该文件中用户的评论和评分介于0到5星之间。我的问题是用户可以发起CSRF攻击，但是我的表单中有CSRF令牌。

我从vue的刀片中检索到它。我把它放在表单中，但似乎此标记有任何作用。

这是我的组成部分：

<template>
<form v-bind:action=this.route @submit.prevent="submit" method="POST" class="comment-form inline-items">
    <input type="hidden" name="_token" v-bind:value="this.csrf">
    <a class="h6 post__author-name fn">{{ this.user[0]['firstname'] }} {{ this.user[0]['lastname'] }}</a>
    <div class="post__author author vcard inline-items">
        <img alt="author">
        <div class="form-group with-icon-right ">
            <textarea name="content" v-model="content" class="form-control" placeholder=""></textarea>
            <star-rating v-model="rating" v-bind:star-size="25"></star-rating>
        </div>
    </div>
    <button type="submit" class="btn btn-md-2 btn-primary">Poster</button>
    <button class="btn btn-md-2 btn-border-think c-grey btn-transparent custom-color">Annuler</button>
</form
</template>

  <script>
import StarRating from 'vue-star-rating';
import axios from 'axios';
let token = document.head.querySelector('meta[name="csrf-token"]');

if (token) {
    window.axios.defaults.headers.common['X-CSRF-TOKEN'] = token.content;
} else {
    console.error('CSRF token not found: https://laravel.com/docs/csrf#csrf-x-csrf-token');
}

export default {
    components: {
        StarRating
    },props: ['csrf','user'],data() {
        return {
            'userid': this.user,'content': '','rating': 0,'route': window.location.pathname,}
    },mounted() {
        console.log('test.')
    },methods: {
        submit:function() {
            axios.post(this.route,{
                content: this.content,rating: this.rating,route: this.route,}).then(function (response) {
                console.log(response)
            })
        },},}

我的app.js：

/**
 * First we will load all of this project's JavaScript dependencies which
 * includes Vue and other libraries. It is a great starting point when
 * building robust,powerful web applications using Vue and Laravel.
 */

require('./bootstrap');

window.Vue = require('vue');

/**
 * The following block of code may be used to automatically register your
 * Vue components. It will recursively scan this directory for the Vue
 * components and automatically register them with their "basename".
 *
 * Eg. ./components/ExampleComponent.vue -> <example-component></example-component>
 */

// const files = require.context('./',true,/\.vue$/i)
// files.keys().map(key => Vue.component(key.split('/').pop().split('.')[0],files(key).default))

Vue.component('example-component',require('./components/ExampleComponent.vue').default);

Vue.component('commentarypost-component',require('./components/CommentarypostComponent.vue').default);
Vue.component('commentary-component',require('./components/CommentaryComponent.vue').default);

Vue.component(
    'passport-clients',require('./components/passport/Clients.vue').default
);

Vue.component(
    'passport-authorized-clients',require('./components/passport/AuthorizedClients.vue').default
);

Vue.component(
    'passport-personal-access-tokens',require('./components/passport/PersonalaccessTokens.vue').default
);

/**
 * Next,we will create a fresh Vue application instance and attach it to
 * the page. Then,you may begin adding components to this application
 * or customize the JavaScript scaffolding to fit your unique needs.
 */

const app = new Vue({
    el: '#app',});

我的刀片：

<div class="container">
    <div class="col col-xl-12 col-12">
        <h2 class="presentation-margin">Poster un commentaire</h2>
    </div>
    <div class="row">
        <div class="col col-lg-6 col-md-12 col-sm-12 col-12">
            <div id="app" class="ui-block">
                <commentarypost-component csrf="{{csrf_token()}}" :user="{{ $user }}"/>
            </div>
        </div>
    </div>
</div>

我的bootstrap.js：

window._ = require('lodash');

/**
 * We'll load jQuery and the Bootstrap jQuery plugin which provides support
 * for JavaScript based Bootstrap features such as modals and tabs. This
 * code may be modified to fit the specific needs of your application.
 */

try {
    window.Popper = require('popper.js').default;
    window.$ = window.jQuery = require('jquery');

    require('bootstrap');
} catch (e) {}

/**
 * We'll load the axios HTTP library which allows us to easily issue requests
 * to our Laravel back-end. This library automatically handles sending the
 * CSRF token as a header based on the value of the "XSRF" token cookie.
 */

window.axios = require('axios');

window.axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';

/**
 * Next we will register the CSRF Token as a common header with Axios so that
 * all outgoing HTTP requests automatically have it attached. This is just
 * a simple convenience so we don't have to attach every token manually.
 */

let token = document.head.querySelector('meta[name="csrf-token"]');

if (token) {
    window.axios.defaults.headers.common['X-CSRF-TOKEN'] = token.content;
} else {
    console.error('CSRF token not found: https://laravel.com/docs/csrf#csrf-x-csrf-token');
}

/**
 * Echo exposes an expressive API for subscribing to channels and listening
 * for events that are broadcast by Laravel. Echo and event broadcasting
 * allows your team to easily build robust real-time web applications.
 */

// import Echo from 'laravel-echo'

// window.Pusher = require('pusher-js');

// window.Echo = new Echo({
//     broadcaster: 'pusher',//     key: process.env.MIX_PUSHER_APP_KEY,//     cluster: process.env.MIX_PUSHER_APP_CLUSTER,//     encrypted: true
// });

以下是输出：

Vuejs outputs

HTML meta

Form output