Hey
I have been facing this problem too and, to solve it, I used a little bit of ChatGPT and Previous Knowledge on Laravel. Well, in my case, I wanted to test a route to register an User. The code below solved my problem:
public function testCreateUserFails()
{
Session::start();
$response = $this->post(route('create_user'), [
"name" => "Leonardo",
"email" => "[email protected]",
"password" => '123',
"_token" => csrf_token()
], [
"XSRF-TOKEN" => csrf_token(),
"_token" => csrf_token()
]);
$response->assertRedirect('/dashboard');
}
Well, to do that, I need to simulate the default behaviour of laravel when it recieves a request from a form with @csrf annotation. So, I need to inject the "_token" inside the payload and generate a token using csrf_token. Then, I need to set the header "XSRF-TOKEN". I think that it is used to determine the origin of the request. At some point, laravel saves an XSRF-TOKEN and every request to laravel sends it again. If you don't send it when you make a request, it'll send a 419 Page Expired. Besides, If you try to simulate it, but send a wrong token inside the request payload, laravel will throw an 500 status code response CSRF Token mismatch. I think that It should be equal to the token sent on the header. It must be unique and exclusive to each client, otherwise It would not be helpful to identification propuses
I'm not sure about all I've explained, but I got this idea while trying to solve this problem. Hope it helps you.