Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

seonppc's avatar

Lumen CSRF Token Mismatch

I am trying to resolve this issue with CSRF setup, here is what i have did...

csrf token in HTML

<input type="hidden" name="_token" value="{{ csrf_token() }}">  

Routes.php

$app->post('/fetch', [
    'middleware' => 'csrf',
    'as' => 'fetchInfo', 'uses' => 'App\Http\Controllers\AppController@fetchInfo'
]);

I am getting following error when form gets submitted...

ErrorException in Application.php line 1267: Undefined index: csrf

Can you please help me to resolve this issue, thanks

0 likes
7 replies
arabsight's avatar

have you un-commented the middleware in the bootstrap/app.php file?

bobbybouwmann's avatar

You need to uncomment this from the bootstrap/app.php file


/*
|--------------------------------------------------------------------------
| Register Middleware
|--------------------------------------------------------------------------
|
| Next, we will register the middleware with the application. These can
| be global middleware that run before and after each request into a
| route or middleware that'll be assigned to some specific routes.
|
*/
$app->middleware([
    'Illuminate\Cookie\Middleware\EncryptCookies',
    'Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse',
    'Illuminate\Session\Middleware\StartSession',
    'Illuminate\View\Middleware\ShareErrorsFromSession',
    'Laravel\Lumen\Http\Middleware\VerifyCsrfToken',
]);

From the documentation for post, put and delete:

You do not need to manually verify the CSRF token on POST, PUT, or DELETE requests. If it is enabled in the bootstrap/app.php file, the Laravel\Lumen\Http\Middleware\VerifyCsrfToken HTTP middleware will verify that the token in the request input matches the token stored in the session.

http://lumen.laravel.com/docs/middleware

seonppc's avatar

@arabsight yes i have already uncommented the same, i have even tried to comment that to discover the issue, but still getting same ever after comment the code block. @blackbird

seonppc's avatar
seonppc
OP
Best Answer
Level 1

This problem got fixed by adding following in app.php...

$app->routeMiddleware([
    'csrf' => 'Laravel\Lumen\Http\Middleware\VerifyCsrfToken'
]);

@JeffreyWay Can you please suggest,why didn't lumen added this at first place?

Thanks

1 like
bashy's avatar

@seonppc

Can you please suggest,why didn't lumen added this at first place?

Because it's a micro-framework? Most things are disabled unless you need them.

jekinney's avatar

Off topic

Have to agree with @bashy seems a lot of questions and statements about lumen are arguably beyond the scope of what lumen is intended for. Micro services that usually enhance something that already exists or does some behind the scenes work to keep the main app performance optimal.

Please or to participate in this conversation.