Level 122
Why keep starting new threads?
Sep 21, 2015
28
Level 1
$request->session()->token() not equal $token
Hello, After pressing the button of login, I am being redirected back to auth/login.
I've noticed that I have a TokenMismatchException because my $request->session()->token() is not equal to $token.
One of the oddest things here is that I didnt have this problem on my previous domain, even though its the exact same code and database.
I am using sessionDrive=file, I tried with database but still the same problem.
On my form I have this:
META-DATA
<meta name="csrf-token" content="BKDMzPtb7xnRRDj4La81z6P3SjNDtSgLuIkzGY2l">
FORM
<form method="POST" action="http://bigansof1.com/demosite/public/auth/login" accept-charset="UTF-8"><input name="_token" type="hidden" value="BKDMzPtb7xnRRDj4La81z6P3SjNDtSgLuIkzGY2l">
It is not hardcoded, I just copied the browsers output.
In the class VerifyCsrfToken method protected function tokensMatch($request) :
protected function tokensMatch($request)
{
$token = $request->input('_token') ?: $request->header('X-CSRF-TOKEN');
if ( ! $token && $header = $request->header('X-XSRF-TOKEN'))
{
$token = $this->encrypter->decrypt($header);
}
return StringUtils::equals($request->session()->token(), $token);
}
These are not equals: $request->session()->token() and $token
Their values are:
array:2 [▼
0 => "ekl9vz8dLi9thN42KL432QYShUrz2Cn8qzhTW5FC"
1 => "zKWDKqKk6j3d0Zy3zMbu0a1FYAHQEx5HQQ9bpVhH"
]
Level 1
@Snapey sorry about that, I'm desperate because this product needs to be up and running. It is not my intention to be anoying.
Level 26
even though its the exact same code and database.
Have you moved the code? Is your storage/framework/sessions writable?
Level 1
Hi @phildawson Yes it is, I also tried changing my driver to database. Do you know where does this header->session->token is generated? I need to know why its value is different than the {!! csrf_token() !!} that I put on my form.
Level 1
yes I moved the code
Level 26
And I assume if it's writable, you're getting the session files created inside that folder?
Is your session config like the default or have you made any changes? https://github.com/laravel/laravel/blob/master/config/session.php
Level 26
Check the Kernel.php in Http for the apps middleware.
Started here
\Illuminate\Session\Middleware\StartSession::class,
calls the start method on the driver. Checks to see if it has _token and then regenerateToken if not.
$session->start();
which is doing
$this->put('_token', Str::random(40));
whilst the token method is the getter
public function token()
{
return $this->get('_token');
}
1 like
Level 1
I have the same, so it should be working fine ... but its not :(
Level 26
@RingoStyle Have you tried removing the vendor directory and doing a composer install again?
Level 1
@phildawson I noticed that it is generating 2 files in the sessions folder, I mean, I deleted all my session files and then refresh the login view. I go back to the session folder and there are 2 files, one contains the {!! csrf_token() !!} and the other does not.
Level 1
I am about to delete folder vendor and doing composer install
Level 1
The problem persists.
Level 3
I'm experiencing the same thing. This leads to a TokenMismatchException I'm struggling with. But it only happens on the server - but not locally with homestead.
Level 1
@obs did you find a solution?
Level 26
@RingoStyle if you know the vendor packages are fine. have you tried cloning a fresh copy and seeing if you have the issue with the auth/login ? If not then just move the files over until it breaks to isolate the cause of the issue.
Level 3
@RingoStyle no, unfortunately not yet. I have a fresh copy and actually tried it multiple times to upload the files freshly.
Level 122
have you tried regenerating the key? I'm not sure how it plays a part, it's just something I would do.
the other thing I would try is clearing the user's remember me token in the users table.
Level 122
also, check the clock on your server
Level 1
@Snapey Ok I am taking a look at the remember me token and the clocks server, what should I look for on the clock? Thank you for your time helping me.
Level 3
@RingoStyle @Snapey I generated a new key, the time on the server is the same as my local time (checked via shh date) and the remember me token is NULL in the DB - but it still doesn't work.
I also deleted the vendor folder and ran composer install - then I got the following lines - do you think some of this suggestions would solve this?
symfony/var-dumper suggests installing ext-symfony_debug ()
symfony/translation suggests installing symfony/config ()
symfony/routing suggests installing doctrine/annotations (For using the annotation loader)
symfony/routing suggests installing symfony/config (For using the all-in-one router or any loader)
symfony/routing suggests installing symfony/expression-language (For using expression matching)
symfony/event-dispatcher suggests installing symfony/dependency-injection ()
symfony/http-kernel suggests installing symfony/browser-kit ()
symfony/http-kernel suggests installing symfony/class-loader ()
symfony/http-kernel suggests installing symfony/config ()
symfony/http-kernel suggests installing symfony/dependency-injection ()
psy/psysh suggests installing ext-pcntl (Enabling the PCNTL extension makes PsySH a lot happier :))
psy/psysh suggests installing ext-pdo-sqlite (The doc command requires SQLite to work.)
psy/psysh suggests installing ext-readline (Enables support for arrow-key history navigation, and showing and manipulating command history.)
monolog/monolog suggests installing aws/aws-sdk-php (Allow sending log messages to AWS services like DynamoDB)
monolog/monolog suggests installing doctrine/couchdb (Allow sending log messages to a CouchDB server)
monolog/monolog suggests installing ext-amqp (Allow sending log messages to an AMQP server (1.0+ required))
monolog/monolog suggests installing ext-mongo (Allow sending log messages to a MongoDB server)
monolog/monolog suggests installing graylog2/gelf-php (Allow sending log messages to a GrayLog2 server)
monolog/monolog suggests installing php-console/php-console (Allow sending log messages to Google Chrome)
monolog/monolog suggests installing raven/raven (Allow sending log messages to a Sentry server)
monolog/monolog suggests installing rollbar/rollbar (Allow sending log messages to Rollbar)
monolog/monolog suggests installing ruflin/elastica (Allow sending log messages to an Elastic Search server)
monolog/monolog suggests installing videlalvaro/php-amqplib (Allow sending log messages to an AMQP server using php-amqplib)
league/flysystem suggests installing league/flysystem-aws-s3-v2 (Allows you to use S3 storage with AWS SDK v2)
league/flysystem suggests installing league/flysystem-aws-s3-v3 (Allows you to use S3 storage with AWS SDK v3)
league/flysystem suggests installing league/flysystem-azure (Allows you to use Windows Azure Blob storage)
league/flysystem suggests installing league/flysystem-cached-adapter (Flysystem adapter decorator for metadata caching)
league/flysystem suggests installing league/flysystem-copy (Allows you to use Copy.com storage)
league/flysystem suggests installing league/flysystem-dropbox (Allows you to use Dropbox storage)
league/flysystem suggests installing league/flysystem-eventable-filesystem (Allows you to use EventableFilesystem)
league/flysystem suggests installing league/flysystem-rackspace (Allows you to use Rackspace Cloud Files)
league/flysystem suggests installing league/flysystem-sftp (Allows you to use SFTP server storage via phpseclib)
league/flysystem suggests installing league/flysystem-webdav (Allows you to use WebDAV storage)
league/flysystem suggests installing league/flysystem-ziparchive (Allows you to use ZipArchive adapter)
laravel/framework suggests installing aws/aws-sdk-php (Required to use the SQS queue driver and SES mail driver (~3.0).)
laravel/framework suggests installing doctrine/dbal (Required to rename columns and drop SQLite columns (~2.4).)
laravel/framework suggests installing guzzlehttp/guzzle (Required to use the Mailgun and Mandrill mail drivers (~5.3|~6.0).)
laravel/framework suggests installing iron-io/iron_mq (Required to use the iron queue driver (~2.0).)
laravel/framework suggests installing league/flysystem-aws-s3-v3 (Required to use the Flysystem S3 driver (~1.0).)
laravel/framework suggests installing league/flysystem-rackspace (Required to use the Flysystem Rackspace driver (~1.0).)
laravel/framework suggests installing pda/pheanstalk (Required to use the beanstalk queue driver (~3.0).)
laravel/framework suggests installing predis/predis (Required to use the redis cache and queue drivers (~1.0).)
laravel/framework suggests installing pusher/pusher-php-server (Required to use the Pusher broadcast driver (~2.0).)
phpdocumentor/reflection-docblock suggests installing dflydev/markdown (~1.0)
phpdocumentor/reflection-docblock suggests installing erusev/parsedown (~1.0)
phpspec/phpspec suggests installing phpspec/nyan-formatters (~1.0 – Adds Nyan formatters)
sebastian/global-state suggests installing ext-uopz (*)
phpunit/php-code-coverage suggests installing ext-xdebug (>=2.2.1)
phpunit/phpunit suggests installing phpunit/php-invoker (~1.1)
Level 26
@obs || @RingoStyle
But it only happens on the server - but not locally with homestead.
If you install a new Laravel on the server, add DB_CONNECTION=sqlite to your .env, touch the storage/database.sqlite, migrate and add the routes/views http://laravel.com/docs/5.1/authentication#included-routing does it work logging in?
ie Without any other code added and nothing else config'd..
Level 3
@phildawson This works. What would you recommend doing next - switching to MySQL or adding the views and other migrations?
Level 26
Hm well I don't think it would be anything with the db. I would try copying into it replacing the app, database, public, resources folders etc from the version that didn't work and then rm the storage/database.sqlite, remake it and then migrate, and then test.
If it fails with your code, then repeat but taking tiny steps in copying stuff over and testing each time until it fails to isolate the issue.
If it works, then happy days. Switch the driver to MySQL again. And check its fine again.
Level 3
@phildawson IT WORKS NOW! Thanks so much for your help. I switched to MySQL, added the Classes, migrations and seeds and it still works. I tried to copy as little as possible and make most things newly on the server (like adding providers and aliases in config/app.php).
Sorry @RingoStyle for somehow taking over your thread - I hope you can solve your issue in that way also.
Level 1
@obs I am glad it works :) @phildawson I am trying your fix now, I will update you with my results, hope it fixes my case too :)
Level 1
Guys, I still dont understand what went wrong here, finally I migrated all to a DigitalOcean server and I have it working perfect! I assume that the apache configuration that was set by default on my previous server had some problems ... Anyway I setup my nginx server myself and have this working. Really thank you for your time :) I appreciate it a lot. Btw, I suggest you using digitalocean for your Laravel projects, if you want you can use this code www.digitalocean.com/?refcode=71624e296bbd And if you need any help setting up the environment dont hesitate on asking me :)
Level 1
I change the permission of sessions directory and solved my problem:
sudo chmod -R 777 storage/framework/sessions
Level 22
Verify that your config/session.php file contains this line
'domain' => env('SESSION_DOMAIN', null),
Then remove the SESSION_DOMAIN line in your .env file
Please or to participate in this conversation.