Level 104
I would suppose your login page is sitting idle for an extended period. You could get that page to refresh automatically every N seconds (within the Session lifetime) , e.g.
<meta http-equiv="refresh" content="6000">
1 like
Nov 7, 2024
10
Level 63
Error 419 Page expired on the login page
Hello,
I try to login to a Laravel application, I see error 419 Page expired for the login page.
I think that it occurs when I don't have logged out and after the session lifetime (some days after) I try to log in.
I remember having already a similar problem when the session cookie was still stored in the browser, but not valid after the session lifetime.
How to prevent to have this error ? Sure I can manually delete the cookie in the browser, but the users won't do that.
Thanks for your help.
V
Level 63
@tykus Ok I will try this.
Thank you ;).
Level 63
@tykus If I refresh the page automatically, will this renew the session ?
Level 104
@vincent15000 no, it will be the same Session if the lifetime has not already expired; otherwise it will be a new Session. This solution is intended to add the meta tag only on the login page.
Why, are you worried about keeping an authenticated user session alive? I would expect the Illuminate\Auth\Middleware\RedirectIfAuthenticated to prevent authenticated users being able to visit the login page in the first case.
1 like
Level 63
@tykus I worry about this because it happened today with an application that I'm developing (it will be in production in March). I think that I have logged in, then I let the page inactive for 3 hours and I got this error.
Level 104
@vincent15000 help me to understand the issue; if you have signed in already, why are you on the login page at all?
1 like
Level 63
@tykus Because the session has expired and I think that the cookie isn't reset in the browser.
Level 122
I propose the same solution here
https://talltips.novate.co.uk/laravel/csrf-and-expired-login-forms
check also the write up about expired logout form
1 like
Level 63
@Snapey Thank you for your answer ... well ... your article is very interesting.
Is your solution a valid solution even if, for example, I log in, then I don't log out, but I just turn off my computer and in some 6 hours I turn it on and I try to log in ?
Level 122
@vincent15000 when you turn on your computer you have no session, until you load the web page, then you have a session and a valid csrf token, so with or without the suggested code, this is not an issue, and is the same as you accessing the site for the very first time
1 like
Please or to participate in this conversation.