title: API: Ajax post in Laravel - 403 (Forbidden)
body: <p>I'm getting <code>403 forbidden</code> during ajax call.
  This is happen only if the <code>ajax</code> is on <code>app.js</code>.
  If I <code>remove</code> from <code>app.js</code> and put to <code>index.blade.php</code>, is working perfectly.</p>
  <p>How can I make it working also on my <code>app.js</code>?
  I've searched a lot, and found I needed to add this</p>
  <blockquote>
  <p>$.ajaxSetup({
  headers: {
  'X-CSRF-TOKEN': $('meta[name=&quot;csrf-token&quot;]').attr('content')
  } });</p>
  </blockquote>
  <p>before the ajax, but is still not working..</p>
  <p>controller:</p>
  <pre><code>&lt;?php
  
  namespace App\Http\Controllers;
  
  use Illuminate\Http\Request;
  use DB;
  
  class API extends Controller
  {
      public function getSomething(Request $r)
      {
          $r-&gt;validate([
              'user' =&gt; 'required'
          ]);
  
          $data = DB::table('posts')-&gt;orderBy('id', 'desc')-&gt;get();
  
  
  
          return $data;
      }
  }
  </code></pre>
  <p>web.php</p>
  <pre><code>Route::group(['prefix' =&gt; 'api'], function(){
      Route::post('getSomething', 'API@getSomething');
  });
  </code></pre>
  <p>index.blade.php</p>
  <pre><code>&lt;script src=&quot;https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js&quot;&gt;&lt;/script&gt;
  &lt;meta name=&quot;csrf-token&quot; content=&quot;{{ csrf_token() }}&quot; /&gt;
  
  .... some of my content ....
  
  &lt;script src=&quot;{{ asset('assets/js/app.js') }}&quot;&gt;&lt;/script&gt;
  </code></pre>
  <p>app.js</p>
  <pre><code>$.ajaxSetup({
      headers: {
          'X-CSRF-TOKEN': $('meta[name=&quot;csrf-token&quot;]').attr('content')
      }
  });
  
  $.ajax({
      url: '{{ url(&quot;api/getSomething&quot;) }}', 
      type: 'POST',
      data: {
          user: '1',
          _token: '{{ csrf_token() }}',
          _testThisAjax: true
      },
      success: function (c) {
          console.log(c);                                         
      },
      error: function(e)
      {
          console.log(e);
      }
  
  });
  </code></pre>