PromptHub
Back to Errors
Laravel Error 419 Intermediate 254 views

TokenMismatchException (CSRF)

The CSRF token validation failed during a POST, PUT, or DELETE request.

Explanation

TokenMismatchException occurs when the CSRF (Cross-Site Request Forgery) token sent with a form submission does not match the token stored in the user's session. Laravel includes CSRF protection by default for all routes except those defined in the VerifyCsrfToken middleware's exceptions. This error commonly happens when sessions expire, when forms are cached by browsers or CDNs, or when making AJAX requests without including the CSRF token. In Laravel 9+, this returns a 419 status code instead of the older 400.

Common Causes

  • Missing @csrf in Blade form
  • AJAX request without CSRF token header
  • Session expired or invalid
  • Cached form with stale token
  • Cookie domain or path mismatch

Solution

Ensure your Blade forms include @csrf directive which outputs the hidden CSRF token field. For AJAX requests, include the X-CSRF-TOKEN header with the token value from the meta tag. Verify that your session driver is configured correctly in .env (SESSION_DRIVER=file or database). Check that the session cookie is not expired and that the session lifetime is appropriate. If using API-only authentication with tokens (Sanctum/Passport), consider disabling CSRF verification for those specific routes.

Code Example 

// Blade form - include @csrf
<form method="POST" action="/posts">
    @csrf
    <input type="text" name="title">
    <button type="submit">Create</button>
</form>

// AJAX request - include CSRF token
axios.post('/posts', data, {
    headers: {
        'X-CSRF-TOKEN': document.querySelector('meta[name="csrf-token"]').content
    }
});

// Or use the built-in axios setup
axios.defaults.headers.common['X-CSRF-TOKEN'] =
    document.querySelector('meta[name="csrf-token"]').content;

// Exempt routes from CSRF (in VerifyCsrfToken.php)
protected $except = ['/api/*'];

Error Information

Language

php

Framework

laravel

Difficulty

Intermediate

Views

254

Related Errors

401 Laravel

AuthenticationException (401)

The user is not authenticated and cannot access the requested resource.
Database

Column Count Doesn't Match

The number of values in an INSERT statement doesn't match the number of columns.
PHP

Type Error: Return Type Must Be Compatible

A method override has a return type that conflicts with the parent class or interface.
PHP

Call to a Member Function on Null

The code calls a method on a variable that is null instead of an object.
All tools