Level 102
Can you show your login page ? I assume its in vue ?
Dec 5, 2022
74
Level 1
Laravel 9 return 419 page expired when try to login
I have a problem with my Laravel 9, Inertia Js, Vue 3, its return 419 page expired or unknown status when try to login.
I have search on google to find solutions, but its still not working.
I have try to add on tag, but its also not working.
Before this problem happen, i try to composer update and install, is that any suggestion for this problem? Thanks before.
My env:
BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=sync
SESSION_DRIVER=file
SESSION_LIFETIME=120
My session file:
<?php
use Illuminate\Support\Str;
return [
/*
|--------------------------------------------------------------------------
| Default Session Driver
|--------------------------------------------------------------------------
|
| This option controls the default session "driver" that will be used on
| requests. By default, we will use the lightweight native driver but
| you may specify any of the other wonderful drivers provided here.
|
| Supported: "file", "cookie", "database", "apc",
| "memcached", "redis", "dynamodb", "array"
|
*/
'driver' => env('SESSION_DRIVER', 'file'),
/*
|--------------------------------------------------------------------------
| Session Lifetime
|--------------------------------------------------------------------------
|
| Here you may specify the number of minutes that you wish the session
| to be allowed to remain idle before it expires. If you want them
| to immediately expire on the browser closing, set that option.
|
*/
'lifetime' => env('SESSION_LIFETIME', 120),
'expire_on_close' => false,
/*
|--------------------------------------------------------------------------
| Session Encryption
|--------------------------------------------------------------------------
|
| This option allows you to easily specify that all of your session data
| should be encrypted before it is stored. All encryption will be run
| automatically by Laravel and you can use the Session like normal.
|
*/
'encrypt' => false,
/*
|--------------------------------------------------------------------------
| Session File Location
|--------------------------------------------------------------------------
|
| When using the native session driver, we need a location where session
| files may be stored. A default has been set for you but a different
| location may be specified. This is only needed for file sessions.
|
*/
'files' => storage_path('framework/sessions'),
/*
|--------------------------------------------------------------------------
| Session Database Connection
|--------------------------------------------------------------------------
|
| When using the "database" or "redis" session drivers, you may specify a
| connection that should be used to manage these sessions. This should
| correspond to a connection in your database configuration options.
|
*/
'connection' => env('SESSION_CONNECTION'),
/*
|--------------------------------------------------------------------------
| Session Database Table
|--------------------------------------------------------------------------
|
| When using the "database" session driver, you may specify the table we
| should use to manage the sessions. Of course, a sensible default is
| provided for you; however, you are free to change this as needed.
|
*/
'table' => 'sessions',
/*
|--------------------------------------------------------------------------
| Session Cache Store
|--------------------------------------------------------------------------
|
| While using one of the framework's cache driven session backends you may
| list a cache store that should be used for these sessions. This value
| must match with one of the application's configured cache "stores".
|
| Affects: "apc", "dynamodb", "memcached", "redis"
|
*/
'store' => env('SESSION_STORE'),
/*
|--------------------------------------------------------------------------
| Session Sweeping Lottery
|--------------------------------------------------------------------------
|
| Some session drivers must manually sweep their storage location to get
| rid of old sessions from storage. Here are the chances that it will
| happen on a given request. By default, the odds are 2 out of 100.
|
*/
'lottery' => [2, 100],
/*
|--------------------------------------------------------------------------
| Session Cookie Name
|--------------------------------------------------------------------------
|
| Here you may change the name of the cookie used to identify a session
| instance by ID. The name specified here will get used every time a
| new session cookie is created by the framework for every driver.
|
*/
'cookie' => env(
'SESSION_COOKIE',
Str::slug(env('APP_NAME', 'laravel'), '_').'_session'
),
/*
|--------------------------------------------------------------------------
| Session Cookie Path
|--------------------------------------------------------------------------
|
| The session cookie path determines the path for which the cookie will
| be regarded as available. Typically, this will be the root path of
| your application but you are free to change this when necessary.
|
*/
'path' => '/',
/*
|--------------------------------------------------------------------------
| Session Cookie Domain
|--------------------------------------------------------------------------
|
| Here you may change the domain of the cookie used to identify a session
| in your application. This will determine which domains the cookie is
| available to in your application. A sensible default has been set.
|
*/
'domain' => env('SESSION_DOMAIN'),
/*
|--------------------------------------------------------------------------
| HTTPS Only Cookies
|--------------------------------------------------------------------------
|
| By setting this option to true, session cookies will only be sent back
| to the server if the browser has a HTTPS connection. This will keep
| the cookie from being sent to you when it can't be done securely.
|
*/
'secure' => env('SESSION_SECURE_COOKIE'),
/*
|--------------------------------------------------------------------------
| HTTP Access Only
|--------------------------------------------------------------------------
|
| Setting this value to true will prevent JavaScript from accessing the
| value of the cookie and the cookie will only be accessible through
| the HTTP protocol. You are free to modify this option if needed.
|
*/
'http_only' => true,
/*
|--------------------------------------------------------------------------
| Same-Site Cookies
|--------------------------------------------------------------------------
|
| This option determines how your cookies behave when cross-site requests
| take place, and can be used to mitigate CSRF attacks. By default, we
| will set this value to "lax" since this is a secure default value.
|
| Supported: "lax", "strict", "none", null
|
*/
'same_site' => 'lax',
];
My app.blade file
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" />
<meta name="csrf-token" content="{{ csrf_token() }}">
<link href="{{ asset('/admin/css/style.css') }}" rel="stylesheet" />
<link href="{{ mix('/css/app.css') }}" rel="stylesheet"/>
<link href="{{ asset('/admin/css/custom.css') }}" rel="stylesheet" />
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Quicksand:wght@300;400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.4/css/all.min.css" />
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"
integrity="sha256-sA+zWATbFveLLNqWO2gtiw3HL/lh1giY/Inf1BJ0z14="
crossorigin=""/>
<script src="{{ asset('/admin/js/coreui.bundle.min.js') }}" defer></script>
<script src="{{ mix('/js/app.js') }}" defer></script>
</head>
<body>
@inertia
</body>
</html>
And i use Fortify and spatie for login and permissions
Level 1
@Sinnbeck Yes its in .vue
my login vue
<template>
<Head>
<title>Login Account - Aplikasi Kasir</title>
</Head>
<div class="col-md-4">
<div class="fade-in">
<div class="text-center mb-4">
<a href="" class="text-dark text-decoration-none">
<img src="/images/logo.png" width="70">
<h3 class="mt-2 font-weight-bold">Sistem Perencanaan Pembangunan Berbasis Wilayah</h3>
</a>
</div>
<div class="card-group">
<div class="card border-top-purple border-0 shadow-sm rounded-3">
<div class="card-body">
<div class="text-start">
<h5>Login ke Dashboard</h5>
<p class="text-muted">Silakan masukkan username dan password</p>
</div>
<hr>
<div v-if="session.status" class="alert alert-success mt-2">
{{ session.status }}
</div>
<form @submit.prevent="submit">
<div class="input-group mb-3">
<div class="input-group-prepend">
<span class="input-group-text">
<i class="fa fa-envelope"></i>
</span>
</div>
<input class="form-control" v-model="form.email" :class="{ 'is-invalid': errors.email }" type="email"
placeholder="Email Address">
</div>
<div v-if="errors.email" class="alert alert-danger">
{{ errors.email }}
</div>
<div class="input-group mb-3">
<div class="input-group-prepend">
<span class="input-group-text">
<i class="fa fa-lock"></i>
</span>
</div>
<input class="form-control" v-model="form.password" :class="{ 'is-invalid': errors.password }"
type="password" placeholder="Password">
</div>
<div v-if="errors.password" class="alert alert-danger">
{{ errors.password }}
</div>
<div class="row">
<div class="col-12 mb-3 text-end">
<Link href="/forgot-password">Forgot Password?</Link>
</div>
<div class="col-12">
<button class="btn btn-primary shadow-sm rounded-sm px-4 w-100" type="submit">LOGIN</button>
</div>
</div>
</form>
</div>
</div>
</div>
</div>
</div>
</template>
<script>
//import layout
import LayoutAuth from '../../Layouts/Auth.vue';
//import reactive
import { reactive } from 'vue';
//import inertia adapter
import { Inertia } from '@inertiajs/inertia';
//import Heade and useForm from Inertia
import {
Head,
Link,
} from '@inertiajs/inertia-vue3';
export default {
//layout
layout: LayoutAuth,
//register component
components: {
Head,
Link
},
props: {
errors: Object,
session: Object
},
//define composition API
setup() {
//define form state
const form = reactive({
email: '',
password: '',
});
//submit method
const submit = () => {
//send data to server
Inertia.post('/login', {
//data
email: form.email,
password: form.password,
});
}
//return form state and submit method
return {
form,
submit,
};
}
}
</script>
<style>
</style>
Level 102
@ashafizullah Try removing the csrf token from the app.blade.php
If you're using Laravel, be sure to omit the csrf-token meta tag from your project, as this will prevent the CSRF token from refreshing properly.
Level 1
@Sinnbeck i have try that too, before that i dont use csrf token meta tag, and i search on google, then i try to add csrf meta tag, but its also not working
Level 102
@ashafizullah You should still remove it. And when I wrote that, I didnt know it was working locally..
Level 1
@Sinnbeck ok sir, i will remove that. But please help me, because the problem is still here
Level 1
Its working on local, but after i deploy to cpanel hosting, Its return 419 when i try to login. I use php 8.0
Level 102
@ashafizullah Ah now thats a very important thing to note. Can you share the login page ?
Level 1
@Sinnbeck i already share my login.vue code in the previous comment sir, or is there any want you want to see?
Level 102
@ashafizullah As it works locally, it is most likely not the code.
I meant the url. If not, check that the domain is exactly the same when it submits. www.domain.com is not the same as domain.com !
Level 1
@Sinnbeck here the url sir data.bappeda.muaraenimkab.go.id/login, i think its already the same domain
Level 102
@ashafizullah It is sending in the csrf token. So it must be something serverside going wrong. Try running php artisan optimize:clear
Level 1
@Sinnbeck done sir, i have run that code, its still 419 now. Please re-check that sir.
Level 102
@ashafizullah I believe you. Can you try
SESSION_DRIVER=cookie
Level 1
@Sinnbeck done sir, its still not working. I also tried database session driver before, and also not working
Level 102
@ashafizullah Hm strange. I cannot see any obvious reason for it failing. Can you try php artisan config:clear also ?
Level 102
And php artisan view:clear
And be sure to run these on the server, not locally
Level 1
@Sinnbeck yes sir, i have tried run that artisan again. But its still no effect. is it possible because i use php 8.0 on cpanel? Because on local i have use 8.1 php
Level 102
@ashafizullah Didnt that give an error when you ran composer install on the server ?
1 like
Level 1
@Sinnbeck here its if i run composer install
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Nothing to install, update or remove
Generating optimized autoload files
> Illuminate\Foundation\ComposerScripts::postAutoloadDump
> @php artisan package:discover --ansi
INFO Discovering packages.
inertiajs/inertia-laravel ................................................................................... DONE
laravel/fortify ............................................................................................. DONE
laravel/sail ................................................................................................ DONE
laravel/sanctum ............................................................................................. DONE
laravel/tinker .............................................................................................. DONE
nesbot/carbon ............................................................................................... DONE
nunomaduro/collision ........................................................................................ DONE
nunomaduro/termwind ......................................................................................... DONE
spatie/laravel-ignition ..................................................................................... DONE
spatie/laravel-permission ................................................................................... DONE
83 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
Level 102
@ashafizullah Ok, it must not be locked to your php version. Did you run alll cache clearing commands?
I am trying to see if there are any knows errors with csrf with cpanel (dont use cpanel myself)
Level 1
@Sinnbeck please tell me the cache clearing command sir, i will try to run it again
Level 102
Just making sure. Did you by any chance set SESSION_DOMAIN? If you did, try removing it from .env
1 like
Level 102
@ashafizullah php artisan config:clear and php artisan view:clear
1 like
Level 1
@Sinnbeck yes i have try to add session_domain = data.bappeda.muaraenimkab.go.id before, and its still not working, so i delete it. I just done to run cache clearing command sir
Level 102
@ashafizullah And its not set to an empty sting then? Just making sure
This will break
SESSION_DOMAIN=
1 like
Level 1
@Sinnbeck no sir, i delete it.
my env now:
BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=sync
SESSION_DRIVER=cookie
SESSION_LIFETIME=120
MEMCACHED_HOST=127.0.0.1
Level 102
@ashafizullah No app key?!
php artisan key:generate
Level 1
@Sinnbeck sorry, here is my full env
APP_NAME=Laravel
APP_ENV=local
APP_KEY=base64:ugGqVg9mnaqIY3BQ/sSQUG2N9oJ+dOxKRL2FsburEgk=
APP_DEBUG=true
APP_URL=ht**tps://data.bappeda.muaraenimkab.go.id
LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug
DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=datadb
DB_USERNAME=dataroot
DB_PASSWORD=password
BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=sync
SESSION_DRIVER=cookie
SESSION_LIFETIME=120
MEMCACHED_HOST=127.0.0.1
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379
MAIL_MAILER=smtp
MAIL_HOST=mailhog
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="${APP_NAME}"
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false
PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_APP_CLUSTER=mt1
MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
Level 102
@ashafizullah Ah ok all good them. Make a new key as you just have shown it to the internet :) And I assume that password is fake ;)
Level 102
Found this thread you can try giving a read
https://stackoverflow.com/questions/62967224/how-to-solve-csrf-token-mismatch-in-laravel
Level 1
@Sinnbeck yes sir its true :D, i have the same project web before this web. Its working perfectly last couple week, and also i dont try to login again these day.
Actually today i ask to my dev ops to give me permission for create this new data.*** subdomain, i dont know after that, this 419 error coming
Level 1
@Sinnbeck yes sir, i just try add ob_start() in my index.php in public folder and run clearing cache
<?php
ob_start();
use Illuminate\Contracts\Http\Kernel;
use Illuminate\Http\Request;
define('LARAVEL_START', microtime(true));
/*
|--------------------------------------------------------------------------
| Check If The Application Is Under Maintenance
|--------------------------------------------------------------------------
|
| If the application is in maintenance / demo mode via the "down" command
| we will load this file so that any pre-rendered content can be shown
| instead of starting the framework, which could cause an exception.
|
*/
if (file_exists($maintenance = __DIR__.'/../storage/framework/maintenance.php')) {
require $maintenance;
}
/*
is im right to add ob_start() here sir?
Level 102
@ashafizullah I cannot say. I have never seen that solution before and have never had the problem myself
Level 102
btw. You should really replace that logo image! Using a 4mb image for a tiny logo is just bad practice
Level 102
Just checked app.js. Did you compile this locally? I notice it has localhost in the code ? I'm considering if this is the problem. DId you hardcode localhost in the code somewhere?
Level 1
@Sinnbeck ok sir, thank you
Level 1
@Sinnbeck yes i run npm run prod that locally, and push to github then pull on the server sir
i do like that one month ago with another project website, and its ok working sir.
Level 102
@ashafizullah link so I can compare? Did you check where localhost comes from?
Level 1
@Sinnbeck here is the link app.js in my local computer sir
jsfiddle.net/#&togetherjs=3wI29GsIIL
Level 1
@Sinnbeck oh ya, i think localhost is from config/app.php
'url' => env('APP_URL', 'htt*p://localhost'),
Level 102
@ashafizullah Ok. See if its also localhost on the site that works (in the compiled app.js)
Level 1
@Sinnbeck yes sir its same. I'm very frustrated and wondering why it's not working on hosting :')
Level 102
@ashafizullah I honestly have no clue. :/ Dont want to share a link to the site that works so I can compare? Im completely out of ideas
Level 1
@Sinnbeck here its the demo for works website sir kasir.appdev.my.id
Level 102
@ashafizullah I am completely clueless then. Maybe compare all settings on the two to see if there are any differences to be found
Level 1
@Sinnbeck i check kasir.appdev.my.id, and its have X-XSRF-TOKEN on header, while on my login page its nothing
Level 102
@ashafizullah Hmm I see it in the session cookie on both. Where are you checking ?
Level 1
@Sinnbeck here the screenshot sir http*s://ibb.co/yYBLht3, i dont find that on my login
Level 102
@ashafizullah Strange. Dont see that one: https://i.imgur.com/Tzhz8UV.png
Level 1
@Sinnbeck at very bottom sir, thats there
Level 1
@Sinnbeck the last one from Request Header section
Level 1
@Sinnbeck its working normally if i comment verifyCsrfToken in Kernel.php sir
protected $middlewareGroups = [
'web' => [
\App\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
// \Illuminate\Session\Middleware\AuthenticateSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
// \App\Http\Middleware\VerifyCsrfToken::class,
\Illuminate\Routing\Middleware\SubstituteBindings::class,
\App\Http\Middleware\HandleInertiaRequests::class,
],
'api' => [
// \Laravel\Sanctum\Http\Middleware\EnsureFrontendRequestsAreStateful::class,
'throttle:api',
\Illuminate\Routing\Middleware\SubstituteBindings::class,
],
];
Level 102
@ashafizullah Yeah without csrf protection the csrf error disappears. That is how it works :)
Level 1
@Sinnbeck but is it save to comment verifyCsrfToken sir? I mean not not best solution
Level 102
@ashafizullah No its a bad solution: It will allow other sites to post data to yours :/
Level 1
@Sinnbeck oh no, i will activate it again. Still havent find the solution :')
Level 102
@ashafizullah I wish I has more ideas: My best suggetion is to compare the one that works with the one that does not :/
Level 1
@Sinnbeck yes sir. I will try that or i will try upload the project to another hosting. Thanks for your suggestions sir
Level 102
@ashafizullah Happy to help, even though we couldnt really solve it yet
Level 1
@Sinnbeck I also got a very good first impression from Laracast, this is my first question
Level 102
@ashafizullah Glad to hear that :)
Level 1
@Sinnbeck I have a new clue, the XSRF-TOKEN on cookies is not generated when login button clicked, its should refresh the page than generated new token.
But on demo website, laravel session and xsrf-token will generate new token when login button clicked.
http*s://i.ibb.co/0h2qHQG/image.png
Level 1
@Sinnbeck yes thanks MASTER is this the problem for my
Level 1
I have the same issue as you @ashafizullah (currently hosting on Heroku) . In addition to all of that my login page is completely messed up, like my CSS is completely broken (and my login has been fully made through the laravel functions), however in local everything works as it should!
Level 1
@iLuca so, its still not working now?
Level 1
@ashafizullah I have no idea to be honest, I just know that I have the same issue as you but in addition to that issue my login CSS is broken :/ I really hope you can find a solution for that error 419 error
Level 1
@iLuca yeah, its weird. Actually 1 month ago, its working. I dont know why today its not working
Level 1
@ashafizullah Are you hosting on Heroku?
Level 1
@iLuca no, its regular hosting
Level 8
Could it be related to the time/timezone of the server being different from the client? Anyway i had the same problem and i was setting the SESSION_DOMAIN to localhost (thanks @sinnbeck)
Level 1
I encountered this issue too but I added these in my .env and it worked SESSION_DOMAIN=localhost SANCTUM_STATEFUL_DOMAINS=localhost
Level 1
Upgrade your php version to the latest and comment the code added by cpanel is for the php version it uses the AddHandler function eg <IfModule mod_rewrite.c> <IfModule mod_negotiation.c> Options -MultiViews -Indexes </IfModule>
RewriteEngine On
# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
# Redirect Trailing Slashes If Not A Folder...
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} (.+)/$
RewriteRule ^ %1 [L,R=301]
# Send Requests To Front Controller...
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]
php -- BEGIN cPanel-generated handler, do not edit
Set the “alt-php83” package as the default “PHP” programming language.
#<IfModule mime_module>
AddHandler application/x-httpd-alt-php83 .php .php8 .phtml
#</IfModule>
php -- END cPanel-generated handler, do not edit
Level 11
i had the same issue and just discovered the solution (in my case at least) thanks to this thread: https://stackoverflow.com/questions/62967224/how-to-solve-csrf-token-mismatch-in-laravel
The use of ob_start() made things work and the comment under that solution led me to my issue: The problem can be something like spaces or line breaks at the very beginning of your php files before you even start the php tags or something more similar to this. This perhaps results in the error as in the question. For more detail information, you can research on why ob_start is used at the very beginning of the php files. – Meeraj Adhikari
I had some rogue whitespace before an opening <?php tag...
Please or to participate in this conversation.