PromptHub
Back to Errors
Laravel Error 419 Intermediate 467 views

TokenMismatchException (CSRF)

The CSRF token validation failed during a POST, PUT, or DELETE request.

Explanation

TokenMismatchException occurs when the CSRF (Cross-Site Request Forgery) token sent with a form submission does not match the token stored in the user's session. Laravel includes CSRF protection by default for all routes except those defined in the VerifyCsrfToken middleware's exceptions. This error commonly happens when sessions expire, when forms are cached by browsers or CDNs, or when making AJAX requests without including the CSRF token. In Laravel 9+, this returns a 419 status code instead of the older 400.

Common Causes

  • Missing @csrf in Blade form
  • AJAX request without CSRF token header
  • Session expired or invalid
  • Cached form with stale token
  • Cookie domain or path mismatch

Solution

Ensure your Blade forms include @csrf directive which outputs the hidden CSRF token field. For AJAX requests, include the X-CSRF-TOKEN header with the token value from the meta tag. Verify that your session driver is configured correctly in .env (SESSION_DRIVER=file or database). Check that the session cookie is not expired and that the session lifetime is appropriate. If using API-only authentication with tokens (Sanctum/Passport), consider disabling CSRF verification for those specific routes.

Code Example 

// Blade form - include @csrf
<form method="POST" action="/posts">
    @csrf
    <input type="text" name="title">
    <button type="submit">Create</button>
</form>

// AJAX request - include CSRF token
axios.post('/posts', data, {
    headers: {
        'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content
    }
});

// Or use the built-in axios setup
axios.defaults.headers.common['X-CSRF-TOKEN'] =
    document.querySelector('meta[name="csrf-token"]').content;

// Exempt routes from CSRF (in VerifyCsrfToken.php)
protected $except = ['/api/*'];

Error Information

Language

php

Framework

laravel

Difficulty

Intermediate

Views

467

Related Errors

Laravel

Laravel Queue Connection Failed

The application cannot connect to the queue driver (Redis, SQS, database, etc.).
Database

Unknown Column

The SQL query references a column that doesn't exist in the specified table.
PHP

Headers Already Sent

The code tries to send HTTP headers after output has already been sent to the browser.
PHP

Type Error: Return Type Must Be Compatible

A method override has a return type that conflicts with the parent class or interface.
All tools