Can't solve TokenMismatchException in VerifyCsrfToken.php line 53

@kirchevsky check your session config path:

'files' => storage_path().'/framework/sessions',

Verify now in project folder structure it is the same.

Remove everything inside the session folder.

Try again.

Tried to clear sessions folder, checked config, tried to move sessions to database. The situation the same.

Sessions config there: http://pastebin.com/255ASyYu

VerifyCsrfToken class there:
http://pastebin.com/zMyTtTpL

App config there: http://pastebin.com/dihYY0EB

Routes there: http://pastebin.com/6xjt5w90

When we try to disable csrf protection it's always redirects us to login page. I think that the problem inside Auth middleware but can`t locate it a few days.

P.S. I`m a beginner, so sorry for some stupid questions :)

@kirchevsky What version of PHP are you running? With Laravel 5.1, you need to be running PHP >= 5.5.9.

Does your browser accept cookies?

PHP - 5.6.2 Browser accept cookies - tested with latest Safari and Chrome.

@kirchevsky Okay, one matter at at time. Unless you've modified VerifyCsrfToken, or the sessions file in a drastic way, no point looking in there. config/app.php does nothing also in this realm.

You say you disable the csrf protection and you get redirected to the login?

• where are you disabling it and how? (code, please)
• which url are you hitting that redirects you to login once you disable csrf?
• when do you get the original error? Is that during login?
• "Using form generator so token is generating for the login form automatically." - What does that mean?
• Have you tried to dump what's being posted during the login? -- IF not place the following in your routes.php instead of

Route::post('auth/login', 'Auth\AuthController@postLogin');

Replace with:

Route::post('auth/login', function(Illuminate\Http\Request $request){
    dd($request);
});

Share your findings then.

Best, sid

sif405, thx for your answer.

VerifyCsrfToken is original now, all modifications i made is commented and that was just a try.

I disabled the csrf security in App\Http\Kernel.php by commenting the line:

//        \App\Http\Middleware\VerifyCsrfToken::class,

The '/home' route redirects me to the login page. Yes, the error is just after we pressing button Login. I mean that i don't put token to the form manually, it present in login form and generated by system. Dump - http://pastebin.com/amQiUmRs

@kirchevsky It makes sense that you'd be directed to the auth if you hit home. You got the following in your routes file

Route::get('/home',[
    'middleware' => 'auth',
    'uses' => 'MainController@index'
]);

Also now let's try to dump

Route::post('auth/login', function(Illuminate\Http\Request $request){
    dd($request->input());
});

Can i see the login view?

sid405, that what we have on dd($request->input()

array:3 [▼
  "_token" => "Z8DpsoKKc6SRAPYnvD0aIEQTn8GfTwvwJUcBWUFC"
  "email" => "xxx@xxx.com"
  "password" => "password"
]

The real data (login+password) replaced with sample data of course.

Login view:

@extends ('cleanlogout')

@section('content')
<div class="text-center">
                        <h3 class="page-header">Login</h3>
                    </div>
<div class="text-center">
<form method="POST" action="/auth/login">
    {!! csrf_field() !!}

    <div class="form-group">
        <label class="control-label">E-mail</label>
        <input class="form-control" type="email" name="email" value="{{ old('email') }}">
    </div>

    <div class="form-group">
        <label class="control-label">Password</label>
        <input class="form-control" type="password" name="password" id="password">
    </div>

    <div class="form-group">
        <input class="form-inline" type="checkbox" name="remember"> Remember Me
    </div>

    <div class="form-group">
        <button class="form-control" type="submit">Login</button>
    </div>
</form>
</div>
@stop

@kirchevsky And even after you comment out Csrf in Kernel.php you get the same?

php artisan clear-compiled
composer dump-autoload

Other than that idk, i'd have to fiddle with the code myself.

Have you had a search round the forum for a similar issue?

The login form from browser:

<form method="POST" action="/auth/login">
    <input type="hidden" name="_token" value="Z8DpsoKKc6SRAPYnvD0aIEQTn8GfTwvwJUcBWUFC">

    <div class="form-group">
        <label class="control-label">E-mail</label>
        <input class="form-control" type="email" name="email" value="">
    </div>

    <div class="form-group">
        <label class="control-label">Password</label>
        <input class="form-control" type="password" name="password" id="password">
    </div>

    <div class="form-group">
        <input class="form-inline" type="checkbox" name="remember"> Remember Me
    </div>

    <div class="form-group">
        <button class="form-control" type="submit">Login</button>
    </div>
</form>

I've searched via Google all similar issues, tried all solutions founded on every website and nothing. The forum topic - it's a last thing i've tried :)

https://dl.dropboxusercontent.com/u/35400710/tg.zip - the full archive of all this, if anybody will try to find a few minutes to help.

Picking it up

@kirchevsky OOOOOOKay. Solved. This was an interesting dive down the rabbit hole.

1. in config/roles.php, remove the white spaces before the <?php tag on the first line. That was preventing your session from being stored and caused that nasty 'Redirecting to ...' screen.

2. In MainController.php remove the guest middleware

// $this->middleware('guest');

You have 'auth' middleware on the route and guest on the controller. This causes a redirect loop and makes your app unusable

3. Enable \App\Http\Middleware\VerifyCsrfToken::class in Kernel.php

4. In config/sessions.php set domain

'domain' => null,

The problem was the cookie stored in the Session was not the one in the form.

5. in views/auth/login

{ {  csrf_field() } } instead of {!! csrf_field() !!}

That's it. Your app works just fine on my end.

Registers and logs in users with csrf protection as per usual. Now you can continue to implement your ACL

Best. sid

Will try :) And... you are my hero )))) Thx a lot!

try :

csrf_token()

instead of:

csrf_field()

Everything works fine. Thank you a lot. Sorry for stupid situation.

@kirchevsky No worries buddy. ps don't forget to vote the answer :D

This solution worked for me:

Add {{ csrf_field() }} anywhere in the form.

i Have:

-   'files' => storage_path('/framework/sessions'),

-   <form method="POST" action="/auth/register">
        {!! csrf_field() !!}

I Do:

-   domain => 'domain.com' 

-   perm. to 777 on the folder -> framework/sessions

it works.

Both routes, the one pointing to a form for registration and that processing registration, are suppose to inside web middleware https://youtu.be/hJIc9lVTJj4?t=23m2s

I know this is fixed but I just discovered another "gotcha" that can cause this (here for posterity). A site I manage has 2 laravel projects, both 5.1 with different keys, when the cookie name in config/session.php was the same I could not solve this issue for anything. Updated one of them to a different cookie name and NOW it works.

After trying about everything i found on the web, kept skipping one part what was the solution ofcourse.. replaced {{ csrf_field() }} with {!! csrf_field() !!} inside the default generated make:auth login/register form.

@sid405 4 years later, the problem persists! need help!

@dragonberr

Problem is with new users, not the functionality that has worked perfectly for 5 years.

Perhaps start a new question so that you can relate your specific situation.

@snapey

well, we'll see! Default package with no edits! will also post as new topic.

PROBLEM:

1. Register page on submit was going to 419 Page Expired option 1 = (experimented by adding it as an exception to VerifyCsrfToken.php, obviously, once that is done the register page works)

**Note 1: register.blade.php

Already has the token.

@csrf

**Note 2: folder permissions

storage > framework > sessions, etc. all have read & write permission

**Note 3: database

Is working (created an user, etc. with the VerifyCsrf exception)