Illuminate\Session\TokenMismatchException: CSRF token mismatch. (419 Page Expired)
ID: php/laravel-csrf-token-mismatch
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| 11 | active | — | — | — |
Root Cause
The 419 CSRF token mismatch error in Laravel occurs when a POST/PUT/PATCH/DELETE request does not include a valid CSRF token. This happens when the session expires, the @csrf directive is missing from forms, or when AJAX requests do not include the X-CSRF-TOKEN header.
genericWorkarounds
-
93% success Include @csrf in all Blade forms and set up the X-CSRF-TOKEN meta tag for AJAX
Add @csrf directive inside every <form> tag in Blade templates. For AJAX requests, add '<meta name="csrf-token" content="{{ csrf_token() }}">' to the layout head. Configure Axios/jQuery to read this meta tag and include it as X-CSRF-TOKEN header on every request. -
87% success Fix session configuration to prevent premature expiration
Check SESSION_DRIVER in .env (use 'database' or 'redis' instead of 'file' for multi-server setups). Increase SESSION_LIFETIME if sessions expire too quickly. Ensure the session storage is writable. For load-balanced environments, use a shared session store (Redis/database) so all servers can validate the same tokens.
Dead Ends
Common approaches that don't work:
-
Disabling CSRF protection globally by removing VerifyCsrfToken middleware
90% fail
Removing CSRF protection exposes the application to cross-site request forgery attacks. Any malicious website can then submit forms on behalf of authenticated users, leading to unauthorized actions like data modification or account takeover.
-
Adding every route to the CSRF exclusion list
85% fail
Excluding all routes from CSRF protection is equivalent to disabling it entirely. This provides no security benefit and leaves the application vulnerable. Only API routes with token-based auth should be excluded.