Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

_rebeccaturner's avatar

Migrating over to AWS - hit with the TokenMismatchException in VerifyCsrfToken.php error

I was wondering if anyone could possibly help? Apologies if its a bit of a noob error - but I'm fairly new to all this.

We're moving our Laravel 5.2 application over to AWS. We currently use a server over at Melbourne which is a pretty similar set-up, after much tinkering with the env files and .htaccess files I've finally got my login screen to show (hurrah!) but now every time I try to login it comes back with this infamous error:

TokenMismatchException in VerifyCsrfToken.php line 67.

I've spent around 4 hours googling and adding the fixes suggested by others and I was wondering if anyone could help? Here's what I've done so far:

  1. Double checked the view has the {{ csrf_token() }} (see form below) - I've also added the meta tag (out of pure desperation I know I'm not using AJAX)
<form class="form-signin" role="form" method="POST" action="{{ url('/auth/login') }}">
                <input type="hidden" name="_token" value="{{ csrf_token() }}">
            <div class="form-group fg-float">
                <div class="fg-line">
                    <input type="text" required autofocus class="input-sm form-control fg-input"  name="username" value="{{ old('username') }}">
                    <label class="fg-label">Username</label>
                </div>
            </div>

            <div class="form-group fg-float">
                <div class="fg-line">
                    <input type="password" required  name="password" class="input-sm form-control fg-input">
                    <label class="fg-label">Password</label>
                </div>
            </div>

            <button  type="submit" class="btn palette-Teal bg">Sign in</button>
            </form>
  1. Check the session.php file for any incorrect settings.
  2. Ran php artisan clear:cache
  3. Updated the application key
  4. Checked the token is actually being generated in the hidden input field.

This is all working fine locally, on staging and on our current live server. Has anybody else had this problem before? I was wondering perhaps it could be due to the fact we've got two servers pointing to one RDS db, both have the application sitting on it (sorry, that might be a silly thing to say but honestly, I'm at my wits end!)

0 likes
1 reply
_rebeccaturner's avatar

Update - the sessions are actually being stored in the sessions folder.

Please or to participate in this conversation.