Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

jgreen's avatar

CSRF Token Mismatch after ajax call in login form

I have a login form with just an email and password field. The email field has an ajax call onBlur to check the user type and then will either redirect to SAML/OAuth auth methods or activate the password field for DB authentication. After updating to Laravel 5.1, I get a token mismatch when going the DB Auth route.

My cookies are encrypted as is my session data. I'm guessing the CSRF Token is updating on the backend when that ajax call occurs, how can I refresh the cookie value on the browser end to the final form submit will match correctly?

0 likes
6 replies
pmall's avatar

Can you describe more precisely what you are trying to achieve please ?

jgreen's avatar

So, I have a login form with an email and password field. When the user blurs off of the email field it executes an ajax call to a findUserType method in my controller. That method determines if the user is a DB authenticated user or a SAML/OAuth authenticated user. If SAML/OAuth it will return the redirection info and the ajax return method will redirect. If the user is a DB user, it will activate the password field to accept user input. However, when I enter the password and submit the form I get a Token Mismatch error. I'm guessing, cause I don't really know how to verify it, that the CSRF token is updating on the backend when this ajax call is made, and the cookie on the browser end then has the wrong token. I am returning the the crsf token, but it doesn't appear to be encrypted and I'm not sure how to update the browser side cookie value so that when the user hits "login" is submits the correct csrf token and avoids the mismatch.

jgreen's avatar

So, to be clear, the ajax call happens after the form is loaded but before the form is submitted. So I guess I just need to know how to properly update the csrf token in the form so when it is submitted it matches.

jgreen's avatar

facepalm

I was doing this to myself with a header modifier plug I use for testing....

jgreen's avatar

yes, I was sending it, I was just under the impression that it would be changing from request to request, which is not the case. Turns out I was overwriting that header with a plug I use for testing and that resulted in null values from the request object. So it was totally my bad....

Please or to participate in this conversation.