Laravel 5.5 login and register page says:The page has expired due to inactivity.[TokenMismatchException]

Question

I just created a new project of laravel version 5.5 with the laravel installer.And run the command "php artisan make:auth".The views and controller are generated for the user authentication.And also run "php artisan migrate" to create tables needed in the database.When visiting the login page and register page,filling the form and submit.It shows "The page has expired due to inactivity. Please refresh and try again.".But refreshing the page does nothing help. Seen in the source code,where causes the exception:

if ($e instanceof ModelNotFoundException) {
        $e = new NotFoundHttpException($e->getMessage(), $e);
    } elseif ($e instanceof AuthorizationException) {
        $e = new AccessDeniedHttpException($e->getMessage());
    } elseif ($e instanceof TokenMismatchException) {
        $e = new HttpException(419, $e->getMessage());
    }

It seems "TokenMismatchException" causing this problem. When did this happen?And why?I just create this new project and did not do any other changes. Hope you got the points. I use php 7.1.9(laravel 5.5 requires php > 7.0.0).And serve the project in develop environment with:php artisan serve

On every page refresh does it create new session file in storage/log folder ? And try SESSION_DOMAIN=localhost in env file — Dhaval, Sep 01 '17 at 06:18
Please refer to this: https://stackoverflow.com/questions/45575735/laravel-spark-csrf-failure-on-login-page — Saurabh, Sep 01 '17 at 06:19
@Dhaval Yes,a new session file created in 'storage/framsework/sessions'. I'v add SESSION_DOMAIN=localhost in the .env file.It still not work — brian.shen, Sep 01 '17 at 06:27
@brian.shen every time you refresh page it's create new session file ? — Dhaval, Sep 01 '17 at 06:30
@Saurabh This is a different situation.Every page refresh,laravel generate a new session.Which causes the csrf token mismatch — brian.shen, Sep 01 '17 at 06:33
I'm having the same issue after upgrading an app from 5.4 to 5.5. And I don't like ad-hoc solutions like "clear your cookies". What if this affects my 10k+ users as well? I don't intend to tell them "clear your cookies". — karni, Sep 01 '17 at 14:14
Having the same issue on my default login process and keep seeing the CSRF solution, which I clearly have. My sessions folder is empty and when I try to login no new session file is created. — Dylan Glockler, Sep 29 '17 at 16:22
I noticed my storage/framework/sessions folder had limited permissions and no file was writing there so I opened them up temp to 777 and now it's writing the session files but i'm still having the same issue. This is only on production. It worked yesterday and works on dev. — Dylan Glockler, Sep 29 '17 at 16:50
Quite sure it has something to do with permissions on the sessions directory. I cloned my application on cloudways and it worked immediately. Permissions seem to get jacked up fairly frequently. I did try chmod on them and did see the session files being created after that, but it still wasn't working. Only my clone saved me and got me working again. — Dylan Glockler, Sep 29 '17 at 18:24

score 31 · Answer 1 · answered Sep 01 '17 at 17:37

31

i think you missed csrf token.

dont forget to use {!! csrf_field() !!}

answered Sep 01 '17 at 17:37

Kokil

560
1
5
16

I've got csrf_field() and have the same issue. (upgrade from 5.4 to 5.5) – karni Sep 01 '17 at 18:28
1

or just `@csrf` in blade.php – Orkhan Alikhanov Aug 16 '18 at 11:21

studiojasper_pl · Accepted Answer · 2017-09-01T10:11:25.520

12

I had the same problem on localhost:8000 (php artisan serve). Maybe it's coincidence, but try on "clean browser" , other than you used with previous development. For me it worked.

It seems that the problem is with cookies from development with previous Laravel versions, on the same url.

edited Sep 01 '17 at 10:11

answered Sep 01 '17 at 10:04

studiojasper_pl

144
6

1

I think this works.I change the browser from chrome to firefox.Everything is fine now. – brian.shen Sep 04 '17 at 03:35
1

I seems to me problem with local environment.Clean cookies works – brian.shen Sep 06 '17 at 04:44
Clean browser and deleting storage\framework\sessions content work for me. – jartaud Sep 12 '17 at 22:25
I restart my computer and the problem solved. – ORHAN ERDAY Mar 16 '21 at 06:31

score 12 · Answer 3 · answered Oct 02 '17 at 06:25

12

In my case, I've got the same error message and then figured that I missed to add csrf_token

{{ csrf_field() }}

Or without form helper that will be,

<input type="hidden" name="_token" value="{{ csrf_token() }}">

If that doesn't work, then-

Refresh the browser cache and hopefully it will work, thanks.

answered Oct 02 '17 at 06:25

Maniruzzaman Akash

4,610
1
37
34

I suppose it's a good test to show the CSRF is working correctly. I'm glad I came across this answer – ChronoFish Nov 08 '17 at 16:49

score 9 · Answer 4 · answered Oct 08 '17 at 20:28

9

I had the same issue and it was because I was using virtualhost and I setup below variable to mydomain.com. in config/session.php file

'domain' => env('SESSION_DOMAIN', 'mydomain.com'),

When I changed it to null then it started working

'domain' => env('SESSION_DOMAIN', 'null'),

I don't know what is the reason behind it but it is working fine now.

answered Oct 08 '17 at 20:28

Afraz Ahmad

5,193
28
38

Yip me too ! Thanks ! – Steve Jul 15 '18 at 02:56
That helped me on Laravel 6 with a similar problem described above. – Maurice Mar 06 '20 at 19:07

score 1 · Answer 5 · answered Sep 08 '17 at 12:16

1

Add csrf token

       <input type="hidden" name="_token" value="{{ csrf_token() }}">

answered Sep 08 '17 at 12:16

shalini

1,291
11
13

score 1 · Answer 6 · answered Sep 29 '17 at 20:45

It appears to be permission settings on either storage and/or bootstrap/cache.

I'm using a Cloudways server. I reset permissions on my server under Application Settings and it now works. On my local development server the equivalent was to set chmod 777 on storage.. I had used 755 previously and the error persisted.

score 1 · Answer 7 · answered Feb 01 '20 at 10:12

try this one in your global handler app/Exceptions/Handler.php

public function render($request, Exception $e)
{
    if ($e instanceof \Illuminate\Session\TokenMismatchException) {

        return redirect('/login');

    }

    return parent::render($request, $e);
}

score 0 · Answer 8 · edited Sep 03 '17 at 04:12

0

I had this same issue. vagrant reload --provision worked for me

edited Sep 03 '17 at 04:12

Buddy

10,874
5
41
58

answered Sep 03 '17 at 04:03

mark edosa

54
4

I tied all provided solutions on other posts, nothing work. other browser like FF and chrome is working fine, but issue with IE. I notice that each time I refresh the login page or register page I got new session file. even I tried vagrant provision command but no luck. Many thanks. – Ahmad.Net Dec 18 '17 at 14:41
I don't know if you're still having this problem, @Ahmad.Net, but I found the solution that worked for me: https://stackoverflow.com/a/39332972/2379279 Turns out that the clock on my Homestead server was out of sync. – Sturm Jan 11 '18 at 18:20

score 0 · Answer 9 · answered Oct 11 '17 at 10:09

0

I would also keep csrf_token in a meta tag.

<meta name="csrf-token" content="{{ csrf_token() }}">

answered Oct 11 '17 at 10:09

Raza Mehdi

923
5
7

score 0 · Answer 10 · answered Oct 26 '17 at 22:59

I was only testing post requests for my api and came across the same issue. I resolved it by adding my route to the Middleware VerifyCsrfToken's $except array i.e. go to app/Http/Middleware/VerifyCsrfToken and add

protected $except = [
        'your/route'
];

But if your requests are from some front-end platform or views, it's advisable to add {{ csrf_field() }} in the form that sends the request.

score 0 · Answer 11 · answered Nov 10 '17 at 14:06

Hi for the group paths that you want to apply to everyone, use this method, which is my 5.5 larval version. Use the star => go to app/Http/Middleware/VerifyCsrfToken and add

protected $except = [
    '/user/*'
];

This is also my user's path

Route::group(['prefix' => 'user', 'namespace' => 'User', 'as' => 'user.'] , function (){

score 0 · Answer 12 · answered Nov 28 '17 at 09:09

This issue is mainly caused because you don't have the csrf token in your form. During csrf token verification it fails, that's why you are getting this page. Laravel generally needs csrf token in all its forms. You can add a csrf token simply by adding this inside the form.

 {{ csrf_field() }}

Another method of doing this is you can exclude your route in the verifycsrftoken middleware.

Just add a protected field in the middleware with your route name.

protected $except=[
                    '1st route',
                    '2nd route',
                    .
                    .
                  ];

This should work.

score 0 · Answer 13 · answered Jan 22 '20 at 07:56

0

Add this code in your

app\Exceptions\Handler.php file

if ($exception instanceof \Illuminate\Session\TokenMismatchException) {
    // Perform operation on page expired
}

answered Jan 22 '20 at 07:56

Rizwan Saleem

904
11
28

score 0 · Answer 14 · answered Jul 04 '20 at 10:58

Sorry for Answering later I had same problem after searching on the internet found two solutions

1-Add

@csrf

or

 <input type="hidden" name="_token" value="{{ csrf_token() }}">

inside your form if missing

2:if you opened you login page for long time and didn't logged in. just refresh the browser or press ctrl+F5

score -1 · Answer 15 · edited Sep 01 '17 at 06:37

-1

Make sure your User.php model exist in app folder and fields must be define in this model.

<?php

namespace App;

use Illuminate\Notifications\Notifiable;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable
{
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array
     */
    protected $fillable = [
        'name', 'email', 'password',
    ];

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'password', 'remember_token',
    ];
}

edited Sep 01 '17 at 06:37

Catalyst

1,018
2
12
19

answered Sep 01 '17 at 06:23

Inderjeet Klsi

104
3

1

Yeah.It's there by defaut.I did not change – brian.shen Sep 01 '17 at 06:29
1

Unfortunately none of the answers given have solved my issue. CSRF token exists, browser session is new, User model is there, still nothing works. When I compare the Session ID with the _token values they are not the same? – DevelumPHP Sep 15 '17 at 06:16

score -1 · Answer 16 · answered Oct 04 '17 at 17:11

-1

if you created a new project localhost You need view config/session line : 166 if 'secure' => true , you need edit 'secure' => false, When you up the host or server, re-config => true sorry i know a little english , hope can help you

answered Oct 04 '17 at 17:11

Scott

1

score -1 · Answer 17 · answered Jan 26 '18 at 12:57

-1

Had this issue as well! Solved it by:

Clearing browser session storage and cookies.
Running php artisan cache:clear
Ensuring the storage/framework/sessions folder was empty, except for the .gitignore.
Restarting dev environment.

answered Jan 26 '18 at 12:57

Doug Black

59
4

Laravel 5.5 login and register page says:The page has expired due to inactivity.[TokenMismatchException]

17 Answers17

Linked

Related