Laravel “419 Page Expired”: CSRF Token Mismatch Causes and Fixes

HTTP status code 419 is a custom status code utilized by Laravel to signify **CSRF Token Mismatch**. Every non-GET request (POST, PUT, DELETE) in Laravel must include a valid CSRF token that matches the token stored in the user's active session. If the token is missing, expired, or invalid, Laravel aborts execution with a 419 error.

### 1. Missing @csrf in Blade Forms Every HTML `

` in Blade must have the `@csrf` directive: ```html @csrf

``` ### 2. Excluding Payment Gateways / Webhooks External services like eSewa or Khalti cannot generate a Laravel session CSRF token. In Laravel 11/12, exclude them in `bootstrap/app.php`: ```php ->withMiddleware(function (Middleware $middleware) { $middleware->validateCsrfTokens(except: [ 'payment/callback/*', 'api/webhook/*' ]); }) ``` ### 3. AJAX / Axios Headers in Single Page Applications If sending requests via JavaScript, include the token in your HTML ``: ```html ``` And configure Axios globally: ```javascript axios.defaults.headers.common['X-CSRF-TOKEN'] = document.querySelector('meta[name="csrf-token"]').getAttribute('content'); ``` ### 4. Storage Folder Permissions on Shared Hosting If Laravel cannot write sessions to `storage/framework/sessions`, sessions are lost immediately on the next request. Run on your server: ```bash chmod -R 775 storage bootstrap/cache ```