419 page expired laravel ERROR

If you are using an application developed in laravel you might get an error saying “419 page expired”.

What is 419 Page Expired

Lets first discuss the 419 HTTP status code. 419 status code Indicates that authentication failed for a previously authenticated request or the authentication key/token has been expired. If you look at the standard HTTP status codes you will not find it there, you can somehow consider it an alternative to 401 which if status code for unauthorized. So, this means when you get a 419 page expired error this means the server is trying to tell you that your authentication for a particular request is expired.

Why you get 419 Page expired in laravel?

Laravel framework has a security feature that helps you in protecting your site from CSRF. If you are wondering why you get this error, read through this example and you will learn about the underlying mechanism of CSRF protection in Laravel and the cause of the error.

Let’s say you accessed the login page of a laravel application in your browser and you got a call from your friend. You were busy talking to your friend and forgot about login to the application and the page stayed there for quite a while. You came back to where you left, you filled the form and Voilá, the error 419 page expired. if you inspect the page or view source code in the browser and have a look at the login form there is this hidden input field with a long string i.e. CSRF token, this token is responsible for protection against CSRF [read more about csrf]. When you left your computer screen and was busy talking to your friend that token got expired and your request was rejected with a 419 HTTP status code.

What might cause the 419 page expire issue

• You are not sending the CSRF token with the form and using verifyCSRF middleware
• You are taking too much time in submitting the request
• you have tampered the hidden token field.
• You have configured session settings properly in the session config file

How to fix this?

The simplest way of fixing the issue is to reload the page. The reload will simply get a new token for you which means you are good to go.

Check for the csrf token in the form you are submitting. Lastly, verify that configuration for domain and cookies is done properly in the session config file.

If you are developing the application you can use some Javascript from time to time to refresh the token. Here is a link as a starter for the solution to your problem.