Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

hraschan's avatar

Laravel - CSRF Token Mismatch - Header Token gets regenerated

I'm struggeling the last 2 weeks on the following problem:

First of all my problem only occours when I try to deploy my current Laravel (6.11) project on the live server. On my Localhost everything works fine.

In every FORM I used the @csrf tag to set the token as well as the meta tag in the head section of my page. If I search into the developer tool in Chrome the tokens in head and form match perfectly. When the POST request gets sent I get an 419 Page Expired error. I figured out that the HEAD token gets recreated on each request so a token mismatch occours.

I already tried the following things:

-Diffrent syntax of the csrf tag

-I excepted all FORMS in the VerifyCsrfToken.php - these ended up in a redirect to my index.php without submited form

-I checked all Laravel config settings which were recommended in diffrent Forum Posts

-I tried a empty laravel installation with a basic login setup on my server - This worked

-I currently work with git. On the a previous commit version (16th of december) which I uploaded to my server on that exact Date I had no problem at all but when I tried to reupload the exact same git commit date, the same problem happens.

Any ideas?

Greatings Max

One example of my forms:

Controller:

function fakeAuthentifizierung(Request $request){
    $username = $request->input('benutzernameLogin');
    $password = $request->input('passwortLogin'); 

    session(['key' => 'mt171043']);
    session(['eingeloggt' => true]);
    /*****
     * ABFRAGE ADMINRECHTE 
     * BITTE DIESEN TEIL SPÄTER IN ECHTE AUTHENTIFIZIERUNG ÜBERNEHMEN
     * 
     */
    $admin = false;
    // SPÄTER BENUTZERID AUS LOGIN  SESSION ÜBERGEBEN
    // astmedin5 als TESTZWECK
    $rechte = Benutzer::getBenutzerBerechtigung("astmedin5");
    //Berechtigung Abfragen
    if($rechte->name != 'Student' && 'Lehrbeauftragter'){
        session(['admin' => true]);
    }else{
        session(['admin' => false]);
    }
    /***
     * 
     * ABFRAGE ENDE
     */

    return redirect(route('index',app()->getlocale()));

}

View:


 <form method="POST" action="{{  action('LoginController@FakeAuthentifizierung', app()->getLocale()) }}">

    @csrf

        <h1>{{ __('Login') }}</h1>
        <label class="col" for="benutzernameLogin">{{ __('Benutzername') }}</label>
        <input name="benutzernameLogin" id="benutzernameLogin" class="inputLogin col mb-4" type="text"
            aria-label="Text input with checkbox" placeholder="{{ __('Benutzername') }}" required>
        <label class="col" for="passwortLogin">{{ __('Passwort') }}</label>
        <input name="passwortLogin" id="passwortLogin" class="inputLogin col mb-4" type="password"
            aria-label="Text input with checkbox" placeholder="{{ __('Passwort') }}" required>
        <div class="col-8 float-left">
            <input id="checkboxPasswortAnzeigen" type="checkbox">
            <label for="checkboxPasswortAnzeigen">{{ __('Passwort anzeigen') }}</label>
        </div>
        <button type="submit" class="btn-slash col-3 inverted fontLight float-right">{{ __('Login') }}</button>

    </form>
0 likes
5 replies
Snapey's avatar

You don't know if it runs apache or nginx?

Anyway, what I was thinking, and I have seen this multiple times, is some stray code before <?php at the start of files.

You need to look at all files committed since your working version and look for anything where <?php are not the first characters of the file (apart from blade files)

hraschan's avatar

@snapey I guess its apache but I'm not sure about that. I checked all files incl. config files. Everything seems fine.

Please or to participate in this conversation.