Laravel Error 419 Intermediate 31 views

TokenMismatchException (CSRF)

The CSRF token validation failed during a POST, PUT, or DELETE request.

Explanation

TokenMismatchException occurs when the CSRF (Cross-Site Request Forgery) token sent with a form submission does not match the token stored in the user's session. Laravel includes CSRF protection by default for all routes except those defined in the VerifyCsrfToken middleware's exceptions. This error commonly happens when sessions expire, when forms are cached by browsers or CDNs, or when making AJAX requests without including the CSRF token. In Laravel 9+, this returns a 419 status code instead of the older 400.

Common Causes

Missing @csrf in Blade form
AJAX request without CSRF token header
Session expired or invalid
Cached form with stale token
Cookie domain or path mismatch

Solution

Ensure your Blade forms include @csrf directive which outputs the hidden CSRF token field. For AJAX requests, include the X-CSRF-TOKEN header with the token value from the meta tag. Verify that your session driver is configured correctly in .env (SESSION_DRIVER=file or database). Check that the session cookie is not expired and that the session lifetime is appropriate. If using API-only authentication with tokens (Sanctum/Passport), consider disabling CSRF verification for those specific routes.

Code Example

// Blade form - include @csrf
<form method="POST" action="/posts">
    @csrf
    <input type="text" name="title">
    <button type="submit">Create</button>
</form>

// AJAX request - include CSRF token
axios.post('/posts', data, {
    headers: {
        'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content
    }
});

// Or use the built-in axios setup
axios.defaults.headers.common['X-CSRF-TOKEN'] =
    document.querySelector('meta[name="csrf-token"]').content;

// Exempt routes from CSRF (in VerifyCsrfToken.php)
protected $except = ['/api/*'];

Error Information

Language

php

Framework

laravel

Difficulty

Intermediate

Views

Related Errors

Laravel

TokenMismatchException (CSRF)

Explanation

Common Causes

Solution

Code Example

Error Information

Related Errors

Laravel Missing Application Encryption Key

Fatal Error: Uncaught Error

Maximum Execution Time Exceeded

Service Unavailable (503)