Everything on middleware.

Laravel 13 PreventRequestForgery: Origin-Aware CSRF Protection in 5 Minutes

Laravel 13 renames VerifyCsrfToken to PreventRequestForgery and adds a Sec-Fetch-Site origin check on top of the token. Here's what changed, how to configure it, and the upgrade traps.