@CsrfProtect
@POST(value = "/articles", name = "articles.store")
private Object store(Request req, Response res) {
    // Token validated automatically
    // If invalid → 403 Forbidden
}

<form method="POST" action="/articles">
    {{ csrf_field() | raw }}

    <input type="text" name="title">
    <button type="submit">Create</button>
</form>

const csrfToken = '{{ csrf_token() }}';

fetch('/articles', {
    method: 'POST',
    headers: {
        'X-CSRF-TOKEN': csrfToken,
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({ title: 'My article' })
});

@POST("/login")
private Object login(Request req, Response res) {
    if (isLogged(req)) {
        regenerateCsrfToken(req);
        res.redirect("/dashboard");
    }
    return null;
}