---
title: CSRF Protection
---

# CSRF Protection

<div class="documentation__toc"></div>

## Introduction

CSRF protection works very much as described in [Laravel documentation](https://laravel.com/docs/csrf). CSRF protection is on and global by default.
 
## Form Integration

When using form builders the CSRF token is included automatically. When using _custom_ form layouts you must use `{{ form.open()|raw }}` in order to retain this automatic functionality. 

If for some reason you need to include the input yourself you can use the `streams plugin` to do so.

[CSRF Plugin Functions](/documentation/streams-platform/latest/reference/streams-plugin#csrf){.link}

## Bypassing CSRF Protection

You can exclude URIs from CSRF protection by adding it to the `streams::security.csrf.except` array or by route.

[Excluding URIs from CSRF Protection via Configuration](/documentation/streams-platform/latest/reference/configuration#csrf-exclusions){.link}

[Excluding URIs from CSRF Protection via Route Variables](/documentation/streams-platform/latest/the-basics/routing#route-variables){.link}
