title: Failed CSRF check! in postman when trying POST method (API with slim 3)
body: <p>I am working with a Slim 3 project and I installed the <a href="https://github.com/slimphp/Slim-Csrf" rel="nofollow noreferrer">CSRF package</a> ("slim/csrf": "^0.8.2",)</p>
  
  <p>In order to make POSTs request I am using postman. When sending the action I get the following error: </p>
  
  <blockquote>
    <p>Failed CSRF check!</p>
  </blockquote>
  
  <p>Here are my API routes (in this case, focus on the POST route):</p>
  
  <pre><code>&lt;?php
  
  /* RESTful endpoints or routes */
  
  use App\Controllers\api\users\UserController;
  
      $app-&gt;group('/api',function () use ($app){
          $app-&gt;group('/users', function () {
              $this-&gt;get('', UserController::class.':index');
              $this-&gt;get('/{id}', UserController::class.':show');
              $this-&gt;post('', UserController::class.':store');
          });
      });
  </code></pre>
  
  <p>Here is the controller supposed to get the info from the POST request where I get the error:</p>
  
  <pre><code>//Save a user via API
      public function store($request,$response,$args)
      {
          //todo: validation!
          var_dump($request-&gt;getParams());//todo: CSRF check failed!
          die();
      }
  </code></pre>
  
  <p>Here is where I registered the CSRF component:</p>
  
  <pre><code>//Register the CSRF Component
  $container['csrf'] = function ($container){
      return new \Slim\Csrf\Guard();
  };
  </code></pre>
  
  <p>I tried this solution: <a href="https://stackoverflow.com/a/48266488/1883256">https://stackoverflow.com/a/48266488/1883256</a> but it didn't work.</p>
  
  <p>Is there any workaround to make it work? How do I prevent the CSRF to run on my API routes?</p>
  
  <p><strong>* Solved *</strong></p>
  
  <p>As <a href="https://stackoverflow.com/a/50195881/1883256">Zamrony P. Juhara</a> suggested, I decided to apply CSRF to the web routes except for the APIs routes.</p>
  
  <p>Grouping all my web routes:</p>
  
  <pre><code>    $app-&gt;group('',function ()use($app,$container){
          /* ******* H O M E ********** */
          require __DIR__ . '/web/home/home.php';
          /* ********** T O P I C  s ********** */
          require __DIR__ . '/web/topics/topics.php';
  
          /* ********** C O N T A C T *********** */
          require __DIR__ . '/web/contact/contact.php';
  
  /* And so on and etcetera ....*/
          /* ********************************************************************************* */
      })-&gt;add($container-&gt;get('csrf'));//Adding CSRF protection only for web routes
  </code></pre>
  
  <p>And, for example, inside the <code>topics.php</code> routes file I have:</p>
  
  <pre><code>$app-&gt;group('/topics',function(){
      $this-&gt;get('',TopicController::class.':index');
      $this-&gt;get('/{id}',TopicController::class.':show')-&gt;setName('topics.show');
  });
  </code></pre>
  
  <p>And as for the API routes, they stay the same.</p>
  
  <p>Finally, inside my container I commented the following:</p>
  
  <pre><code>//$app-&gt;add($container-&gt;get('csrf')); //I've commented this line in order to add CSRF for specific routes (all except APIs ones)
  </code></pre>