title: Laravel 4: Prevent multiple form submissions - CSRF Token
body: <p><strong>Problem scenario:</strong></p>
  
  <p>I'm creating a blog with Laravel 4. The form that's responsible for the creation of new blog posts is secured by the build in CSRF protection (<a href="http://laravel.com/docs/html#csrf-protection" rel="noreferrer">Laravel Docs: CSRF Protection</a>).</p>
  
  <p>Everything works fine so far, but it seems that laravel does not refresh the csrf token on every request.</p>
  
  <p>The problem that occurs is that if the user hits the back button of the browser to return to the submitted form, the entered data persists and the user is able to "re-submit" the form. This might create an open door for spammers.</p>
  
  <p>Usually this is prevented by the CSRF token, as it's being refreshed on every request, but Laravel doesn't seem to do it like that.</p>
  
  <p>I use the laravel "Resource Controller" approach (<a href="http://laravel.com/docs/controllers#resource-controllers" rel="noreferrer">Laravel Docs: Resource Controllers</a>) to handle the form and blog post views. Furthermore I use Laravels input validator before storing the submitted input in the database (MySQL).</p>
  
  <p><br />
  <strong>So the following ideas came up:</strong></p>
  
  <ol>
  <li><p>somehow force Laravel 4 to regenerate the csrf automatically on every request</p></li>
  <li><p>generate another token and include it into the form manually</p></li>
  <li><p>save a timestamp of form submition in the users session (php or database) and throttle new form submissions on a time base</p></li>
  </ol>
  
  <p>Personally I prefer the first idea, but unfortunately I couldn't find a way of forcing laravel to behave how I want it to be, without hacking the "Illuminate" itself (which I want to keep "as is" to be able to update laravel without "hassle<i>hoff</i>" ^^).</p>
  
  <p><strong>What would you recommend?</strong></p>
  
  <p><strong>How did you handle the problem yourself?</strong></p>