Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

danielgwood's avatar

Strange 419 Page Expired Error (not caused by CSRF Token)

I have a complex form that uses some validators in an injected FormRequest class to ensure that the data comes through to the controller already validated. Practically every submission goes through fine, except for one particular user. Whenever I try to post this user's data through the form, I get a 419 Page Expired error. It's not the CSRF token as it is definitely submitted with the form.

I've tried reproducing the exact same dataset via a post in a PhpUnit Test, but it submits without any error, even when I turn on CSRF verification (bypassing the "isTesting" check) and session interaction. I would love to able to reproduce the bug, but can't seem to find the right set of data.

I have a feeling it might be the following code. It is conditionally building a set of rules based on what is already in the request's input array (require them if present, ignore if not). The required_if validation rule doesn't seem to cover this situation. Could it be this code that is causing the problem?

$request->base is an array:

if (array_key_exists('different_secondary_address', $request->base)) {
	$differentSecondaryAddress = $request->base['different_secondary_address'];
} else {
	$differentSecondaryAddress = false;
}

It's quite difficult for me to remove this from production without potentially breaking it for other users. Unfortunately I have limited a environment (no staging setup unfortunately).

A couple of the potential solutions that might work:

  1. Avoid checking this altogether, and add hidden inputs to the form.
  2. Create a custom validator

I would appreciate any help, especially if you've had the 419 error that isn't caused by the CSRF validation.

Thanks in advance!

0 likes
2 replies
bugsysha's avatar

Anything in logs or more info about why this is happening? Can you enable debug mode while you test it on production to see a better picture of the issue?

danielgwood's avatar

Thanks for this, but there there aren't any errors other than the 419. It doesn't even hit the controller. I think there might be an issue with my validation code in the FormRequest, so I'll look at rewriting that at some stage. In the end I just ended up entering the data manually into the database!!

Please or to participate in this conversation.