<?php

namespace App\Http\Middleware;

use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;

class VerifyCsrfToken extends Middleware
{
    /**
     * URIs that are excluded from CSRF verification.
     * 'login' is excluded so POST /login works when session cookie is not sent (e.g. http, wrong domain).
     * Ensure SESSION_SECURE_COOKIE=false and SESSION_DOMAIN is empty when using http://.
     */
    protected $except = [
        'login',
    ];
}