title: Filter CSRF token to secure against CSRF
body: <p>I am following this article <a href="http://blog.neoxia.com/laravel4-and-angularjs/" rel="nofollow">http://blog.neoxia.com/laravel4-and-angularjs/</a> to set up and filter the CSRF token. 
  I am able to make it working on local server but after I deployed live and tested it, I keep getting "status code 418". Any idea?</p>
  
  <p>Below is my code:</p>
  
  <p>Route.php:</p>
  
  <pre><code>// Route to filter CSRF
  Route::filter('serviceCSRF',function(){
  if (Session::token() != Request::header('csrf_token')) {
      return Response::json([
          'message' =&gt; 'Security token doesn\'t match, possible CSRF attack.'
      ], 418);
  }
  });
  
  // Route for authentication
  Route::group(['prefix' =&gt; 'api/auth', 'after' =&gt; 'allowOrigin'], function() {
  
  Route::get('check', [
      'as'=&gt;'check_auth_path',
      'uses'=&gt;'SessionsController@check'
  ]);
  
  Route::post('login', [
      'as'=&gt;'login_path',
      'uses'=&gt;'SessionsController@login'
  ]);
  
  Route::get('sentryLogout', [
      'as'=&gt;'logout_path',
      'uses'=&gt;'SessionsController@logout'
  ]);
  });
  </code></pre>
  
  <p>Session Controller:</p>
  
  <pre><code>class SessionsController extends \BaseController {
  
  public function __construct() {
      $this-&gt;beforeFilter('serviceCSRF');
  }
  ...
  </code></pre>
  
  <p>app.js:</p>
  
  <pre><code>var xhReq = new XMLHttpRequest();
  xhReq.open("GET", "//" + window.location.hostname + "/api/csrf", false);
  xhReq.send(null);
  
  app.constant("CSRF_TOKEN", xhReq.responseText);
  
  app.run(function ($window, $couchPotato, $rootScope, $state, $stateParams, $http, CSRF_TOKEN) {
      app.lazy = $couchPotato;
      $rootScope.$state = $state;
      $rootScope.$stateParams = $stateParams;
      // editableOptions.theme = 'bs3';
  
      $http.defaults.headers.common['csrf_token'] = CSRF_TOKEN;
  
      // watch for location path change
      $rootScope.$on("$locationChangeStart",function() {
  
      ....
  </code></pre>